Skip to content
Fencer Intel
high 8.5

CVE-2022-36093 json

XWiki Platform Web Templates vulnerable to Unauthorized User Registration Through the Distribution Wizard

published 4y ago modified 4mo ago also GHSA-h5j3-5x63-p8jv , EUVD-2022-6835

cvss
8.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.9%
EPSS 0.9% chance of exploitation in 30 days, percentile 59%
public exploits
0
none known

Summary

XWiki Platform Web Templates are templates for XWiki Platform, a generic wiki platform. By passing a template of the distribution wizard to the xpart template, user accounts can be created even when user registration is disabled. This also circumvents any email verification. Before versions 14.2 and 13.10.4, this can also be exploited on a private wiki, thus potentially giving the attacker access to the wiki. Depending on the configured default rights of users, this could also give attackers write access to an otherwise read-only public wiki. Users can also be created when an external authentication system like LDAP is configured, but authentication fails unless the authentication system supports a bypass/local accounts are enabled in addition to the external authentication system. This issue has been patched in XWiki 13.10.5 and 14.3RC1. As a workaround, one may replace `xpart.vm`, the entry point for this attack, by a patched version from the patch without updating XWiki.

Patch / fix

  • maven org.xwiki.platform:xwiki-platform-web-templates 13.10.5, 14.3-rc-1
  • maven org.xwiki.platform:xwiki-platform-web 13.10.5, 14.3-rc-1
  • xwiki xwiki 13.10.5, 14.3

Is CVE-2022-36093 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
last yr.

Exploit prediction

0.89% chance of exploitation in the next 30 days, higher than 59% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.1 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N
NVD 3.1 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
GitHub 3.1 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N

Affected packages

ecosystem package affected fixed in
maven org.xwiki.platform:xwiki-platform-web-templates
<13.10.5
>=14.0, <14.3-rc-1
13.10.5
14.3-rc-1
maven org.xwiki.platform:xwiki-platform-web
>=8.0-rc-1, <13.10.5
>=14.0, <14.3-rc-1
13.10.5
14.3-rc-1

Affected products

  • xwiki xwiki-platform

Classification

Weakness
  • CWE-288 Authentication Bypass Using an Alternate Path or Channel
  • CWE-287 Improper Authentication

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.