GHSA-q6jp-gcww-8v2j

Source

https://github.com/advisories/GHSA-q6jp-gcww-8v2j

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/11/GHSA-q6jp-gcww-8v2j/GHSA-q6jp-gcww-8v2j.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-q6jp-gcww-8v2j

Aliases

CVE-2022-41937

Published

2022-11-21T23:46:47Z

Modified

2023-11-01T05:00:06Z

Severity

9.6 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N CVSS Calculator

Summary

Missing Authorization in Filter Stream Converter Application of XWiki-platform

Details

Impact

The application allow anyone with view access to modify any page of the wiki by importing a crafted XAR package.

Patches

The problem has been patched in XWiki 14.6RC1, 14.6 and 13.10.8.

Workarounds

The problem can be patched immediately by setting the right of the page Filter.WebHome and making sure only main wiki administrators can VIEW it the application is installed on main wiki or edit the page and apply the changed described on https://github.com/xwiki/xwiki-platform/commit/fb49b4f289ee28e45cfada8e97e320cd3ed27113.

References

For more information

If you have any questions or comments about this advisory:

Open an issue in JIRA
Email us at security ML

Database specific

{
    "cwe_ids":  [
        "CWE-862"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2022-11-21T23:46:47Z",
    "nvd_published_at":  "2022-11-22T01:15:00Z",
    "severity":  "CRITICAL"
}

References

Affected packages

Maven

org.xwiki.platform:xwiki-platform-filter-ui

Package

Name: org.xwiki.platform:xwiki-platform-filter-ui; View open source insights on deps.dev
Purl: pkg:maven/org.xwiki.platform/xwiki-platform-filter-ui

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

13.10.8

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/11/GHSA-q6jp-gcww-8v2j/GHSA-q6jp-gcww-8v2j.json"

org.xwiki.platform:xwiki-platform-filter-ui

Package

Name: org.xwiki.platform:xwiki-platform-filter-ui; View open source insights on deps.dev
Purl: pkg:maven/org.xwiki.platform/xwiki-platform-filter-ui

Affected ranges

Type: ECOSYSTEM
Events: Introduced

14.0.0

Fixed

14.4.3

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/11/GHSA-q6jp-gcww-8v2j/GHSA-q6jp-gcww-8v2j.json"

org.xwiki.platform:xwiki-platform-filter-ui

Package

Name: org.xwiki.platform:xwiki-platform-filter-ui; View open source insights on deps.dev
Purl: pkg:maven/org.xwiki.platform/xwiki-platform-filter-ui

Affected ranges

Type: ECOSYSTEM
Events: Introduced

14.5.0

Fixed

14.6-rc-1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/11/GHSA-q6jp-gcww-8v2j/GHSA-q6jp-gcww-8v2j.json"