What is the severity of CVE-2022-39387?

CVE-2022-39387 is classified as a moderate severity vulnerability.

How do I fix CVE-2022-39387?

To fix CVE-2022-39387, you should upgrade to XWiki OpenID Connect version 1.29.1 or later.

What does CVE-2022-39387 affect?

CVE-2022-39387 affects XWiki OpenID Connect versions prior to 1.29.1.

What vulnerability does CVE-2022-39387 exploit?

CVE-2022-39387 exploits the ability to manipulate OpenID provider details through request parameters.

Is CVE-2022-39387 related to OpenID Connect?

Yes, CVE-2022-39387 specifically pertains to vulnerabilities within the OpenID Connect protocol implementation in XWiki.

Vulnerability/
CVE-2022-39387

critical

9.1

CWE

287

4/11/2022

23/4/2025

CVE-2022-39387: XWiki OIDC Authenticator vulnerable to OpenID login bypass due to improper authentication

First published: Fri Nov 04 2022(Updated: )

XWiki OIDC has various tools to manipulate OpenID Connect protocol in XWiki. Prior to version 1.29.1, even if a wiki has an OpenID provider configured through its xwiki.properties, it is possible to provide a third party provider its details through request parameters. One can then bypass the XWiki authentication altogether by specifying its own provider through the oidc.endpoint.* request parameters (or by using an XWiki-based OpenID provider with oidc.xwikiprovider. With the same approach, one could also provide a specific group mapping through oidc.groups.mapping that would make his user automatically part of the XWikiAdminGroup. This issue has been patched, please upgrade to 1.29.1. There is no workaround, an upgrade of the authenticator is required.

Credit: security-advisories@github.com

Affected Software	Affected Version	How to fix
OpenID Connect	<1.29.1

Remedy

https://github.com/xwiki-contrib/oidc/commit/0247af1417925b9734ab106ad7cd934ee870ac89

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is the severity of CVE-2022-39387?
CVE-2022-39387 is classified as a moderate severity vulnerability.
How do I fix CVE-2022-39387?
To fix CVE-2022-39387, you should upgrade to XWiki OpenID Connect version 1.29.1 or later.
What does CVE-2022-39387 affect?
CVE-2022-39387 affects XWiki OpenID Connect versions prior to 1.29.1.
What vulnerability does CVE-2022-39387 exploit?
CVE-2022-39387 exploits the ability to manipulate OpenID provider details through request parameters.
Is CVE-2022-39387 related to OpenID Connect?
Yes, CVE-2022-39387 specifically pertains to vulnerabilities within the OpenID Connect protocol implementation in XWiki.

agent/type
collector/mitre-cve
source/MITRE
agent/references
agent/remedy
agent/author
agent/last-modified-date
agent/title
agent/weakness
agent/severity
agent/first-publish-date
agent/event
agent/description
agent/source
agent/softwarecombine
agent/tags
collector/nvd-index
agent/software-canonical-lookup-request
vendor/xwiki
canonical/openid connect

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.