CVE-2022-24898: xwiki commons

csirt@kutim:~/threat-intel/cve/CVE-2022-24898

CVSS 4.9 · Medium EPSS 1,5%

Kerentanan Improper Restriction of XML External Entity Reference pada xwiki commons. Skor CVSS 3.1 4.9 (Medium) menurut NVD.

Deskripsi (NVD)

org.xwiki.commons:xwiki-commons-xml is a common module used by other XWiki top level projects. Starting in version 2.7 and prior to versions 12.10.10, 13.4.4, and 13.8-rc-1, it is possible for a script to access any file accessing to the user running XWiki application server with XML External Entity Injection through the XML script service. The problem has been patched in versions 12.10.10, 13.4.4, and 13.8-rc-1. There is no easy workaround for fixing this vulnerability other than upgrading and being careful when giving Script rights.

Rincian

Terbit di NVD: 28 April 2022
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 4.9 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-611: Improper Restriction of XML External Entity Reference
EPSS (30 hari): 1,5% peluang dieksploitasi; lebih tinggi dari 73,3% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
xwiki	commons	Versi 2.7 hingga sebelum 12.10.10
xwiki	commons	Versi 13.0 hingga sebelum 13.4.4
xwiki	commons	Versi 13.5 hingga sebelum 13.8

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://jira.xwiki.org/browse/XWIKI-18946 exploit · advisory vendor
https://github.com/xwiki/xwiki-commons/commit/947e8921ebd95462d5a7928f397dd1b64f77c7d5 patch · advisory pihak ketiga
https://github.com/xwiki/xwiki-commons/security/advisories/GHSA-m2r5-4w96-qxg5 advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.