Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.4

XWiki Platform: Unauthorized Access to API with Elevated Rights

CVE-2022-23615 · published 4 years ago
Summary

A user with limited permissions can gain access to sensitive areas of the platform by exploiting a security flaw. This could allow them to perform actions they shouldn't be able to. To fix this, update to the latest version of XWiki, version 13.0 or later. Alternatively, consider limiting access to the SCRIPT feature.

What to do
  • Update xwiki org.xwiki.platform:xwiki-platform-oldcore to version 13.0.
  • Update xwiki xwiki to version 13.0 or later.
Affected software
Ecosystem VendorProductAffected versions
maven xwiki org.xwiki.platform:xwiki-platform-oldcore >= 1.0, < 13.0
Fix: upgrade to 13.0
– xwiki xwiki >= 1.0, < 13.0
cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*
Original advisory text
Partial authorization bypass on document save in xwiki-platform
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with SCRIPT right can save a document with the right of the current user which allow accessing API requiring programming right if the current user has programming right. This has been patched in XWiki 13.0. Users are advised to update to resolve this issue. The only known workaround is to limit SCRIPT access.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.4 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-863Incorrect Authorization
Timeline
Published9 Feb 2022
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-f4cj-3q3h-884r · GHSA
CVE-2022-23615 · NVD
CVE-2022-23615 · OSV
Track software like this
Free during beta