CVE-2022-36092: XWiki Platform Old Core vulnerable to Authentication Bypass Using the Login Action
First published: Thu Sep 08 2022(Updated: )
XWiki Platform Old Core is a core package for XWiki Platform, a generic wiki platform. Prior to versions 14.2 and 13.10.4, all rights checks that would normally prevent a user from viewing a document on a wiki can be bypassed using the login action and directly specified templates. This exposes title, content and comments of any document and properties of objects, though class and property name must be known. This is also exploitable on private wikis. This has been patched in versions 14.2 and 13.10.4 by properly checking view rights before loading documents and disallowing non-default templates in the login, registration and skin action. As a workaround, it would be possible to protect all templates individually by adding code to check access rights first.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Xwiki | <13.10.4 | |
| Xwiki | >=14.0<14.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/xwiki/xwiki-platform/commit/71a6d0bb6f8ab718fcfaae0e9b8c16c2d69cd4bb
- https://github.com/xwiki/xwiki-platform/commit/9b7057d57a941592d763992d4299456300918208
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-8h89-34w2-jpfm
- https://jira.xwiki.org/browse/XWIKI-18602
- https://jira.xwiki.org/browse/XWIKI-19549
Frequently Asked Questions
What is the severity of CVE-2022-36092?
CVE-2022-36092 has been classified as a high severity vulnerability due to the potential for unauthorized access to protected documents.
How do I fix CVE-2022-36092?
To fix CVE-2022-36092, upgrade to XWiki Platform version 14.2 or 13.10.4 or later.
What does CVE-2022-36092 affect?
CVE-2022-36092 affects versions of XWiki Platform prior to 14.2 and 13.10.4, allowing rights checks to be bypassed.
What type of vulnerability is CVE-2022-36092?
CVE-2022-36092 is a rights bypass vulnerability, which can allow unauthorized users to view documents.
Who is at risk from CVE-2022-36092?
Users of XWiki Platform versions before 14.2 and 13.10.4 are at risk from CVE-2022-36092.
- agent/type
- agent/remedy
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- agent/references
- agent/title
- agent/weakness
- agent/author
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/xwiki
- canonical/xwiki
- version/xwiki/14.0