CVE-2022-24897

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2022-24897
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-24897.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2022-24897
Aliases
Published
2022-05-02T21:49:17Z
Modified
2025-11-28T03:38:14.389761Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Arbitrary filesystem write access from Velocity
Details

APIs to evaluate content with Velocity is a package for APIs to evaluate content with Velocity. Starting with version 2.3 and prior to 12.6.7, 12.10.3, and 13.0, the velocity scripts are not properly sandboxed against using the Java File API to perform read or write operations on the filesystem. Writing an attacking script in Velocity requires the Script rights in XWiki so not all users can use it, and it also requires finding an XWiki API which returns a File. The problem has been patched in versions 12.6.7, 12.10.3, and 13.0. There is no easy workaround for fixing this vulnerability other than upgrading and being careful when giving Script rights.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24897.json",
    "cwe_ids": [
        "CWE-22"
    ]
}
References

Affected packages

Git / github.com/xwiki/xwiki-commons

Affected ranges

Type
GIT
Repo
https://github.com/xwiki/xwiki-commons
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
215951cfb0f808d0bf5b1097c9e7d1e503449ab8

Affected versions

xwiki-commons-7.*

xwiki-commons-7.3-milestone-2
xwiki-commons-7.4-milestone-1
xwiki-commons-7.4-milestone-2

xwiki-commons-8.*

xwiki-commons-8.0-milestone-1
xwiki-commons-8.0-milestone-2
xwiki-commons-8.1-milestone-1
xwiki-commons-8.1-milestone-2
xwiki-commons-8.2-milestone-1
xwiki-commons-8.2-milestone-2
xwiki-commons-8.3-milestone-1
xwiki-commons-8.3-milestone-2

Database specific

vanir_signatures

[
    {
        "signature_version": "v1",
        "signature_type": "Function",
        "deprecated": false,
        "digest": {
            "function_hash": "81047757659018862351086404442862922365",
            "length": 1398.0
        },
        "id": "CVE-2022-24897-4c37a146",
        "target": {
            "file": "xwiki-commons-core/xwiki-commons-velocity/src/main/java/org/xwiki/velocity/introspection/SecureIntrospector.java",
            "function": "SecureIntrospector"
        },
        "source": "https://github.com/xwiki/xwiki-commons/commit/215951cfb0f808d0bf5b1097c9e7d1e503449ab8"
    },
    {
        "signature_version": "v1",
        "signature_type": "Line",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "202394429013584469158929458879958634353",
                "181148629691150244035287895161789671538",
                "224178537737055095463356229114566892523",
                "337538851078687409294225754395710517681",
                "249144457320600783359085821244945853082",
                "242612171403726548546824953538574664630",
                "68146638085292745189437561555096364689",
                "116040269509476801474778274482731424614",
                "31774409285169054903789992675175177601",
                "96714594055467343777462830770547337318",
                "133350704650583275964021978934345587649",
                "241339319350465438365381171999863077653",
                "159578003708463785192015073673995364950",
                "214184409866757609294555981322371736907",
                "193344973784968206287686942585649445098",
                "74394074304681410059942995147613868519",
                "167195114767789636567541524995634296850",
                "92254153025524336311394787276550807832",
                "83945657811172430405146359899577193113",
                "253179382255359584764532178534765223339",
                "254896546999533729734267532882527511394",
                "125075636430362056009103032305167272298",
                "334751400252548827609335358528127802563",
                "101791069282214869639722160811292500697",
                "108526341238523054577048305158658491589",
                "66123881420453359894661734138061945396",
                "124148333752830145946248207779194551977",
                "215306742493624284920644758944805102333",
                "269655171716462989669659703648430572948",
                "329290905499266757080164546841691967860",
                "78307552667088413888639196004978822416",
                "44318239446369339244604623232684152979",
                "264069095915209038807507043285231561913",
                "41252578697756345207110241338847130885",
                "312471430061378302118540457700183030896",
                "335065649087304534818440826426849174018",
                "315430065841200070154246929533232076302",
                "239411350000153063525743577097059792553",
                "337631567085904590639950589807604892065",
                "3911290578341732463806332700867732455"
            ]
        },
        "id": "CVE-2022-24897-7e00fae7",
        "target": {
            "file": "xwiki-commons-core/xwiki-commons-velocity/src/main/java/org/xwiki/velocity/introspection/SecureIntrospector.java"
        },
        "source": "https://github.com/xwiki/xwiki-commons/commit/215951cfb0f808d0bf5b1097c9e7d1e503449ab8"
    },
    {
        "signature_version": "v1",
        "signature_type": "Function",
        "deprecated": false,
        "digest": {
            "function_hash": "117454811291613861019966194123129666404",
            "length": 228.0
        },
        "id": "CVE-2022-24897-d26aacf4",
        "target": {
            "file": "xwiki-commons-core/xwiki-commons-velocity/src/main/java/org/xwiki/velocity/introspection/SecureIntrospector.java",
            "function": "checkObjectExecutePermission"
        },
        "source": "https://github.com/xwiki/xwiki-commons/commit/215951cfb0f808d0bf5b1097c9e7d1e503449ab8"
    }
]

Git / github.com/xwiki/xwiki-platform

Affected ranges

Type
GIT
Repo
https://github.com/xwiki/xwiki-platform
Events
Introduced
1bf0361e80e94dd763901e3a863b4caaa24b6e17
Fixed
82cca0679aa3d0e04a0f64e74d30f4ba79e0d416