CVE-2022-23615: Partial authorization bypass on document save in xwiki-platform

February 9, 2022 (updated February 11, 2022)

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with SCRIPT right can save a document with the right of the current user which allow accessing API requiring programming right if the current user has programming right. This has been patched in XWiki 13.0. Users are advised to update to resolve this issue. The only known workaround is to limit SCRIPT access.

References

github.com/advisories/GHSA-f4cj-3q3h-884r
github.com/xwiki/xwiki-platform/commit/7ab0fe7b96809c7a3881454147598d46a1c9bbbe
github.com/xwiki/xwiki-platform/security/advisories/GHSA-f4cj-3q3h-884r
jira.xwiki.org/browse/XWIKI-5024
nvd.nist.gov/vuln/detail/CVE-2022-23615

Detect and mitigate CVE-2022-23615 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →