CVE-2022-41937

Katalog CVE

CVSS 8.1 · High EPSS 0,79%

Kerentanan Missing Authorization pada xwiki. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The application allows anyone with view access to modify any page of the wiki by importing a crafted XAR package. The problem has been patched in XWiki 14.6RC1, 14.6 and 13.10.8. As a workaround, setting the right of the page Filter.WebHome and making sure only the main wiki administrators can view the application installed on main wiki or edit the page and apply the changed described in commit fb49b4f.

Rincian

Terbit di NVD

22 November 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-862: Missing Authorization

EPSS (30 hari)

0,79% peluang dieksploitasi; lebih tinggi dari 55,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://jira.xwiki.org/browse/XWIKI-19758 advisory vendor
• https://github.com/xwiki/xwiki-platform/commit/fb49b4f289ee28e45cfada8e97e320cd3ed27113 patch · advisory pihak ketiga
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-q6jp-gcww-8v2j patch · advisory pihak ketiga