CVE-2022-41936: Exposure of Private Personal Information to an Unauthorized Actor in xwiki-platform-rest-server
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The modifications rest endpoint does not filter out entries according to the user's rights. Therefore, information hidden from unauthorized users are exposed though the modifications rest endpoint (comments and page names etc). Users should upgrade to XWiki 14.6+, 14.4.3+, or 13.10.8+. Older versions have not been patched. There are no known workarounds.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
xwiki-platform-rest-server (XWiki)to a version that resolves this vulnerability.Fixed in 14.6+ - Upgrade
Upgrade
xwiki-platform-rest-server (XWiki)to a version that resolves this vulnerability.Fixed in 14.4.3+ - Upgrade
Upgrade
xwiki-platform-rest-server (XWiki)to a version that resolves this vulnerability.Fixed in 13.10.8+
Event History
Frequently Asked Questions
What is CVE-2022-41936?
CVE-2022-41936 is a vulnerability in the XWiki Platform that allows unauthorized users to access hidden information through the modifications rest endpoint.
How does CVE-2022-41936 affect XWiki?
CVE-2022-41936 affects XWiki versions between 8.1 and 13.10.8, as well as versions between 14.0 and 14.4.3, and versions 14.5 to 14.6.
What is the severity of CVE-2022-41936?
The severity of CVE-2022-41936 is high, with a CVSSv3 base score of 7.5.
How can I fix CVE-2022-41936?
To fix CVE-2022-41936, it is recommended to upgrade to a patched version of XWiki Platform or apply the necessary security patches.
Where can I find more information about CVE-2022-41936?
You can find more information about CVE-2022-41936 in the XWiki Platform's GitHub repository, security advisories, and the XWiki JIRA issue.