CVE-2022-24821: Incorrect Use of Privileged APIs in org.xwiki.platform.skin.skinx
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Simple users can create global SSX/JSX without specific rights: in theory only users with Programming Rights should be allowed to create SSX or JSX that are executed everywhere on a wiki. But a bug allow anyone with edit rights to actually create those. This issue has been patched in XWiki 13.10-rc-1, 12.10.11 and 13.4.6. There's no easy workaround for this issue, administrators should upgrade their wiki.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2022-24821?
CVE-2022-24821 has been classified as a high severity vulnerability due to improper access control that allows unauthorized users to create global scripts.
How do I fix CVE-2022-24821?
To fix CVE-2022-24821, update XWiki to the latest version that addresses this vulnerability.
What versions of XWiki are affected by CVE-2022-24821?
CVE-2022-24821 affects XWiki versions from 12.0.0 to 12.10.11, and from 13.4.0 to 13.4.6, as well as version 13.10.
What are the potential impacts of CVE-2022-24821?
The potential impacts of CVE-2022-24821 include unauthorized script execution and possible compromise of the XWiki platform.
Can CVE-2022-24821 be exploited remotely?
Yes, CVE-2022-24821 can be exploited remotely by users lacking appropriate permissions.