CVE-2022-24898: Arbitrary file access through XML parsing in org.xwiki.commons:xwiki-commons-xml
org.xwiki.commons:xwiki-commons-xml is a common module used by other XWiki top level projects. Starting in version 2.7 and prior to versions 12.10.10, 13.4.4, and 13.8-rc-1, it is possible for a script to access any file accessing to the user running XWiki application server with XML External Entity Injection through the XML script service. The problem has been patched in versions 12.10.10, 13.4.4, and 13.8-rc-1. There is no easy workaround for fixing this vulnerability other than upgrading and being careful when giving Script rights.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID of this vulnerability?
The vulnerability ID of this vulnerability is CVE-2022-24898.
What is the severity of CVE-2022-24898?
The severity of CVE-2022-24898 is medium with a severity value of 4.9.
What is the affected software of CVE-2022-24898?
The affected software of CVE-2022-24898 is XWiki Commons versions 2.7 to 12.10.10, 13.0 to 13.4.4, and 13.5 to 13.8.
What is the description of CVE-2022-24898?
CVE-2022-24898 is a vulnerability in org.xwiki.commons:xwiki-commons-xml that allows a script to access any file, potentially exposing sensitive information.
How can I fix CVE-2022-24898?
To fix CVE-2022-24898, update XWiki Commons to version 12.10.10, 13.4.4, or 13.8-rc-1.