<p>Upgrade <code>org.xwiki.platform:xwiki-platform-oldcore</code> to version 12.10.9, 13.4.3, 13.7-rc-1 or higher.</p>

Missing Authorization Affecting org.xwiki.platform:xwiki-platform-oldcore package, versions [,12.10.9) [13.0.0, 13.4.3) [13.5.0, 13.7-rc-1)

Snyk CVSS

Attack Complexity High

Privileges Required High

Availability High

Threat Intelligence

EPSS 0.1% (41^st percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk ID SNYK-JAVA-ORGXWIKIPLATFORM-2397362
published 10 Feb 2022
disclosed 10 Feb 2022
credit Unknown

Report a new vulnerability Found a mistake?

Introduced: 10 Feb 2022

CVE-2022-23621 Open this link in a new tab CWE-22 Open this link in a new tab CWE-552 Open this link in a new tab CWE-862 Open this link in a new tab

How to fix?

Upgrade org.xwiki.platform:xwiki-platform-oldcore to version 12.10.9, 13.4.3, 13.7-rc-1 or higher.

Overview

org.xwiki.platform:xwiki-platform-oldcore is a generic wiki platform offering runtime services for applications built on top of it.

Affected versions of this package are vulnerable to Missing Authorization via the xwiki.invokeServletAndReturnAsString() function that takes the path to any file located in XWiki WAR as an argument (i.e "/WEB-INF/xwiki.cfg") by a user with SCRIPT (EDIT before version 7.4) permission.

Workaround

Limit SCRIPT permissions.