What is CVE-2022-41936?

CVE-2022-41936 is a vulnerability in the XWiki Platform that allows unauthorized users to access hidden information through the modifications rest endpoint.

How does CVE-2022-41936 affect XWiki?

CVE-2022-41936 affects XWiki versions between 8.1 and 13.10.8, as well as versions between 14.0 and 14.4.3, and versions 14.5 to 14.6.

What is the severity of CVE-2022-41936?

The severity of CVE-2022-41936 is high, with a CVSSv3 base score of 7.5.

How can I fix CVE-2022-41936?

To fix CVE-2022-41936, it is recommended to upgrade to a patched version of XWiki Platform or apply the necessary security patches.

Where can I find more information about CVE-2022-41936?

You can find more information about CVE-2022-41936 in the XWiki Platform's GitHub repository, security advisories, and the XWiki JIRA issue.

Vulnerability/
CVE-2022-41936

high

7.5

CWE

359

22/11/2022

3/8/2024

CVE-2022-41936: Exposure of Private Personal Information to an Unauthorized Actor in xwiki-platform-rest-server

First published: Tue Nov 22 2022(Updated: )

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The `modifications` rest endpoint does not filter out entries according to the user's rights. Therefore, information hidden from unauthorized users are exposed though the `modifications` rest endpoint (comments and page names etc). Users should upgrade to XWiki 14.6+, 14.4.3+, or 13.10.8+. Older versions have not been patched. There are no known workarounds.

Credit: security-advisories@github.com

Affected Software	Affected Version	How to fix
Xwiki Xwiki	>=8.1<13.10.8
Xwiki Xwiki	>=14.0<14.4.3
Xwiki Xwiki	>=14.5<14.6

Remedy

https://github.com/xwiki/xwiki-platform/commit/38dc1aa1a4435f24d58f5b8e4566cbcb0971f8ff

Remedy

https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-p88w-fhxw-xvcc

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is CVE-2022-41936?
CVE-2022-41936 is a vulnerability in the XWiki Platform that allows unauthorized users to access hidden information through the modifications rest endpoint.
How does CVE-2022-41936 affect XWiki?
CVE-2022-41936 affects XWiki versions between 8.1 and 13.10.8, as well as versions between 14.0 and 14.4.3, and versions 14.5 to 14.6.
What is the severity of CVE-2022-41936?
The severity of CVE-2022-41936 is high, with a CVSSv3 base score of 7.5.
How can I fix CVE-2022-41936?
To fix CVE-2022-41936, it is recommended to upgrade to a patched version of XWiki Platform or apply the necessary security patches.
Where can I find more information about CVE-2022-41936?
You can find more information about CVE-2022-41936 in the XWiki Platform's GitHub repository, security advisories, and the XWiki JIRA issue.

collector/nvd-index
agent/type
agent/softwarecombine
agent/remedy
collector/mitre-cve
source/MITRE
agent/references
agent/author
agent/last-modified-date
agent/severity
agent/weakness
agent/title
agent/first-publish-date
agent/tags
agent/description
agent/event
vendor/xwiki
canonical/xwiki xwiki
version/xwiki xwiki/8.1
version/xwiki xwiki/14.0
version/xwiki xwiki/14.5

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.