CVE-2022-23617: Missing authorization in xwiki-platform
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with edit right can copy the content of a page it does not have access to by using it as template of a new page. This issue has been patched in XWiki 13.2CR1 and 12.10.6. Users are advised to update. There are no known workarounds for this issue.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2022-23617?
CVE-2022-23617 is considered a high severity vulnerability as it allows users with edit rights to access restricted page content.
How do I fix CVE-2022-23617?
To fix CVE-2022-23617, update to XWiki version 12.10.6 or later, or versions 13.0.1 and 13.1.1.
Which versions of XWiki are affected by CVE-2022-23617?
CVE-2022-23617 affects XWiki versions up to and including 12.10.5, as well as versions 13.0 and 13.1.
What are the implications of CVE-2022-23617 for users?
Users with edit rights can exploit this vulnerability to view and copy content from protected pages, compromising data confidentiality.
Has CVE-2022-23617 been patched?
Yes, CVE-2022-23617 has been patched in the latest versions of XWiki following the discovery of the vulnerability.