GHSA-q6jp-gcww-8v2j

Source

https://github.com/advisories/GHSA-q6jp-gcww-8v2j

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/11/GHSA-q6jp-gcww-8v2j/GHSA-q6jp-gcww-8v2j.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-q6jp-gcww-8v2j

Aliases

CVE-2022-41937

Published

2022-11-21T23:46:47Z

Modified

2023-11-01T05:00:06.999032Z

Severity

9.6 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N CVSS Calculator

Summary

Missing Authorization in Filter Stream Converter Application of XWiki-platform

Details

Impact

The application allow anyone with view access to modify any page of the wiki by importing a crafted XAR package.

Patches

The problem has been patched in XWiki 14.6RC1, 14.6 and 13.10.8.

Workarounds

The problem can be patched immediately by setting the right of the page Filter.WebHome and making sure only main wiki administrators can VIEW it the application is installed on main wiki or edit the page and apply the changed described on https://github.com/xwiki/xwiki-platform/commit/fb49b4f289ee28e45cfada8e97e320cd3ed27113.

References

https://github.com/xwiki/xwiki-platform/commit/fb49b4f289ee28e45cfada8e97e320cd3ed27113
https://jira.xwiki.org/browse/XWIKI-19758

For more information

If you have any questions or comments about this advisory: * Open an issue in JIRA * Email us at security ML

Database specific

{
    "nvd_published_at": "2022-11-22T01:15:00Z",
    "github_reviewed_at": "2022-11-21T23:46:47Z",
    "severity": "CRITICAL",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-862"
    ]
}

References

Affected packages

Maven / org.xwiki.platform:xwiki-platform-filter-ui

Package

Name: org.xwiki.platform:xwiki-platform-filter-ui; View open source insights on deps.dev
Purl: pkg:maven/org.xwiki.platform/xwiki-platform-filter-ui

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

13.10.8

Maven / org.xwiki.platform:xwiki-platform-filter-ui

Package

Name: org.xwiki.platform:xwiki-platform-filter-ui; View open source insights on deps.dev
Purl: pkg:maven/org.xwiki.platform/xwiki-platform-filter-ui

Affected ranges

Type: ECOSYSTEM
Events: Introduced

14.0.0

Fixed

14.4.3

Maven / org.xwiki.platform:xwiki-platform-filter-ui

Package

Name: org.xwiki.platform:xwiki-platform-filter-ui; View open source insights on deps.dev
Purl: pkg:maven/org.xwiki.platform/xwiki-platform-filter-ui

Affected ranges

Type: ECOSYSTEM
Events: Introduced

14.5.0

Fixed

14.6-rc-1