CVE-2022-24821
Assigner: GitHub_M
Published: 2022-04-08T18:55:10
State: PUBLISHED
affected: product: xwiki-platform
vendor: xwiki
versions: status: affected
version: > 3.1M1
descriptions: value: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Simple users can create global SSX/JSX without specific rights: in theory only users with Programming Rights should be allowed to create SSX or JSX that are executed everywhere on a wiki. But a bug allow anyone with edit rights to actually create those. This issue has been patched in XWiki 13.10-rc-1, 12.10.11 and 13.4.6. There's no easy workaround for this issue, administrators should upgrade their wiki.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
version: 3.1
problemTypes: descriptions: cweId: CWE-648
description: CWE-648: Incorrect Use of Privileged APIs
type: CWE
source: advisory: GHSA-ghcq-472w-vf4h
discovery: UNKNOWN
title: Incorrect Use of Privileged APIs in org.xwiki.platform.skin.skinx