CVE-2022-41932: Creation of new database tables through login form on PostgreSQL
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to make XWiki create many new schemas and fill them with tables just by using a crafted user identifier in the login form. This may lead to degraded database performance. The problem has been patched in XWiki 13.10.8, 14.6RC1 and 14.4.2. Users are advised to upgrade. There are no known workarounds for this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
XWiki Platformto a version that resolves this vulnerability.Fixed in 13.10.8 - Upgrade
Upgrade
XWiki Platformto a version that resolves this vulnerability.Fixed in 14.6RC1 - Upgrade
Upgrade
XWiki Platformto a version that resolves this vulnerability.Fixed in 14.4.2
Event History
Frequently Asked Questions
What is the severity of CVE-2022-41932?
CVE-2022-41932 is considered a high-severity vulnerability due to its potential impact on database performance.
How do I fix CVE-2022-41932?
To fix CVE-2022-41932, upgrade to XWiki version 14.4.4 or later, or any version above 13.10.8 that does not contain the vulnerability.
What are the affected versions of XWiki in CVE-2022-41932?
The affected versions of XWiki include all versions up to 13.10.8, as well as versions from 14.0.0 to 14.4.2 and from 14.5.0 to 14.6.
What type of attack does CVE-2022-41932 exploit?
CVE-2022-41932 allows attackers to use a crafted user identifier in the login form to create multiple new schemas in the XWiki database.
Is CVE-2022-41932 a local or remote vulnerability?
CVE-2022-41932 is a remote vulnerability since it can be exploited through the web interface of the XWiki application.