CVE-2022-23615 json
Partial authorization bypass on document save in xwiki-platform
published 4y ago modified 4mo ago also GHSA-f4cj-3q3h-884r , EUVD-2022-0969
- cvss
- 5.4
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 52%
- public exploits
- 0
- none known
Summary
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with SCRIPT right can save a document with the right of the current user which allow accessing API requiring programming right if the current user has programming right. This has been patched in XWiki 13.0. Users are advised to update to resolve this issue. The only known workaround is to limit SCRIPT access.
Patch / fix
- maven org.xwiki.platform:xwiki-platform-oldcore 13.0
- xwiki xwiki 13.0
Is CVE-2022-23615 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- last yr.
Exploit prediction
0.68% chance of exploitation in the next 30 days, higher than 52% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N |
| NVD | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N |
| NVD | 2.0 | 5.5 | AV:N/AC:L/Au:S/C:P/I:P/A:N |
| GitHub | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.xwiki.platform:xwiki-platform-oldcore | >=1.0, <13.0 |
13.0 |
Affected products
- xwiki xwiki-platform
Classification
- Weakness
-
- CWE-863 Incorrect Authorization
References
-
github.com
/xwiki/xwiki-platform/commit/7ab0fe7b96809c7a3881454147598d46a1c9bbbe
web, patch, third-party-advisory
-
jira.xwiki.org
/browse/XWIKI-5024
web, patch, vendor-advisory
-
github.com
/xwiki/xwiki-platform/security/advisories/GHSA-f4cj-3q3h-884r
web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2022-23615
advisory
-
github.com
/xwiki/xwiki-platform
package
Sources
- CVE List CVE-2022-23615
- GitHub Advisory GHSA-f4cj-3q3h-884r
- NVD CVE-2022-23615
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.