Vulnerability-Lookup

CVE-2022-24821 (GCVE-0-2022-24821)

Vulnerability from cvelistv5 – Published: 2022-04-08 18:55 – Updated: 2025-04-22 18:17

Title

Incorrect Use of Privileged APIs in org.xwiki.platform.skin.skinx

Summary

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Simple users can create global SSX/JSX without specific rights: in theory only users with Programming Rights should be allowed to create SSX or JSX that are executed everywhere on a wiki. But a bug allow anyone with edit rights to actually create those. This issue has been patched in XWiki 13.10-rc-1, 12.10.11 and 13.4.6. There's no easy workaround for this issue, administrators should upgrade their wiki.

Severity

6.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-04-22 15:48 UTC

CWE

CWE-648 - Incorrect Use of Privileged APIs

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7761 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/xwiki/xwiki-platform/security/…	x_refsource_CONFIRM
https://jira.xwiki.org/browse/XWIKI-19155	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
xwiki	xwiki-platform	Affected: > 3.1M1	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T04:20:50.511Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-ghcq-472w-vf4h"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jira.xwiki.org/browse/XWIKI-19155"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-24821",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-22T15:48:58.877982Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-22T18:17:02.831Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "xwiki-platform",
          "vendor": "xwiki",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e 3.1M1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Simple users can create global SSX/JSX without specific rights: in theory only users with Programming Rights should be allowed to create SSX or JSX that are executed everywhere on a wiki. But a bug allow anyone with edit rights to actually create those. This issue has been patched in XWiki 13.10-rc-1, 12.10.11 and 13.4.6. There\u0027s no easy workaround for this issue, administrators should upgrade their wiki."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-648",
              "description": "CWE-648: Incorrect Use of Privileged APIs",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-04-08T18:55:09.000Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-ghcq-472w-vf4h"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jira.xwiki.org/browse/XWIKI-19155"
        }
      ],
      "source": {
        "advisory": "GHSA-ghcq-472w-vf4h",
        "discovery": "UNKNOWN"
      },
      "title": "Incorrect Use of Privileged APIs in org.xwiki.platform.skin.skinx",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2022-24821",
          "STATE": "PUBLIC",
          "TITLE": "Incorrect Use of Privileged APIs in org.xwiki.platform.skin.skinx"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "xwiki-platform",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003e 3.1M1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "xwiki"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Simple users can create global SSX/JSX without specific rights: in theory only users with Programming Rights should be allowed to create SSX or JSX that are executed everywhere on a wiki. But a bug allow anyone with edit rights to actually create those. This issue has been patched in XWiki 13.10-rc-1, 12.10.11 and 13.4.6. There\u0027s no easy workaround for this issue, administrators should upgrade their wiki."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-648: Incorrect Use of Privileged APIs"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-ghcq-472w-vf4h",
              "refsource": "CONFIRM",
              "url": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-ghcq-472w-vf4h"
            },
            {
              "name": "https://jira.xwiki.org/browse/XWIKI-19155",
              "refsource": "MISC",
              "url": "https://jira.xwiki.org/browse/XWIKI-19155"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-ghcq-472w-vf4h",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2022-24821",
    "datePublished": "2022-04-08T18:55:10.000Z",
    "dateReserved": "2022-02-10T00:00:00.000Z",
    "dateUpdated": "2025-04-22T18:17:02.831Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-24821",
      "date": "2026-10-16",
      "epss": "0.00804",
      "percentile": "0.55906"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "xwiki-platform",
                "vendor": "xwiki",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003e 3.1M1"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "F4D7FF74-F74E-4F9A-B40E-91BE45A9A672",
                    "versionEndExcluding": "12.10.11",
                    "versionStartIncluding": "12.0.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D0A3A358-6C84-4C66-B2F1-7F53955BF9A4",
                    "versionEndExcluding": "13.4.6",
                    "versionStartIncluding": "13.4.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:xwiki:xwiki:13.10:-:*:*:*:*:*:*",
                    "matchCriteriaId": "4B1453B3-C5F1-4C51-8094-FECBBD6F0988",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Simple users can create global SSX/JSX without specific rights: in theory only users with Programming Rights should be allowed to create SSX or JSX that are executed everywhere on a wiki. But a bug allow anyone with edit rights to actually create those. This issue has been patched in XWiki 13.10-rc-1, 12.10.11 and 13.4.6. There\u0027s no easy workaround for this issue, administrators should upgrade their wiki."
          },
          {
            "lang": "es",
            "value": "La plataforma XWiki es una plataforma wiki gen\u00e9rica que ofrece servicios de tiempo de ejecuci\u00f3n para aplicaciones construidas sobre ella. Los usuarios simples pueden crear SSX/JSX globales sin derechos espec\u00edficos: en teor\u00eda, s\u00f3lo los usuarios con derechos de programaci\u00f3n deber\u00edan poder crear SSX o JSX que sean ejecutados en cualquier lugar de un wiki. Pero un error permite que cualquiera con derechos de edici\u00f3n pueda crearlos. Este problema ha sido parcheado en XWiki versiones 13.10-rc-1, 12.10.11 y 13.4.6. No se presenta una mitigaci\u00f3n f\u00e1cil para este problema, los administradores deben actualizar su wiki"
          }
        ],
        "id": "CVE-2022-24821",
        "lastModified": "2026-06-17T04:32:35.697",
        "metrics": {
          "cvssMetricV2": [
            {
              "acInsufInfo": false,
              "baseSeverity": "MEDIUM",
              "cvssData": {
                "accessComplexity": "LOW",
                "accessVector": "NETWORK",
                "authentication": "SINGLE",
                "availabilityImpact": "NONE",
                "baseScore": 5.5,
                "confidentialityImpact": "PARTIAL",
                "integrityImpact": "PARTIAL",
                "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:N",
                "version": "2.0"
              },
              "exploitabilityScore": 8.0,
              "impactScore": 4.9,
              "obtainAllPrivilege": false,
              "obtainOtherPrivilege": false,
              "obtainUserPrivilege": false,
              "source": "nvd@nist.gov",
              "type": "Primary",
              "userInteractionRequired": false
            }
          ],
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.8,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.3,
              "impactScore": 4.0,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 8.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.2,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2022-24821",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-22T15:48:58.877982Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2022-04-08T19:15:08.257",
        "references": [
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-ghcq-472w-vf4h"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Exploit",
              "Issue Tracking",
              "Patch",
              "Third Party Advisory"
            ],
            "url": "https://jira.xwiki.org/browse/XWIKI-19155"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-ghcq-472w-vf4h"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Exploit",
              "Issue Tracking",
              "Patch",
              "Third Party Advisory"
            ],
            "url": "https://jira.xwiki.org/browse/XWIKI-19155"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-648"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2025-05-29T01:45:12+00:00",
      "cve": "CVE-2022-24821",
      "id": "CVE-2022-24821",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Incorrect Use of Privileged APIs in org.xwiki.platform.skin.skinx",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-24821.json",
      "version": "3"
    }
  }
}

FKIE_CVE-2022-24821

Vulnerability from fkie_nvd - Published: 2022-04-08 19:15 - Updated: 2026-06-17 04:32

Severity

6.8 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
8.1 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-ghcq-472w-vf4h	Third Party Advisory
security-advisories@github.com	https://jira.xwiki.org/browse/XWIKI-19155	Exploit, Issue Tracking, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-ghcq-472w-vf4h	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://jira.xwiki.org/browse/XWIKI-19155	Exploit, Issue Tracking, Patch, Third Party Advisory

Impacted products

Vendor	Product	Version
xwiki	xwiki	*
xwiki	xwiki	*
xwiki	xwiki	13.10

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "xwiki-platform",
          "vendor": "xwiki",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e 3.1M1"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "F4D7FF74-F74E-4F9A-B40E-91BE45A9A672",
              "versionEndExcluding": "12.10.11",
              "versionStartIncluding": "12.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "D0A3A358-6C84-4C66-B2F1-7F53955BF9A4",
              "versionEndExcluding": "13.4.6",
              "versionStartIncluding": "13.4.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:xwiki:xwiki:13.10:-:*:*:*:*:*:*",
              "matchCriteriaId": "4B1453B3-C5F1-4C51-8094-FECBBD6F0988",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Simple users can create global SSX/JSX without specific rights: in theory only users with Programming Rights should be allowed to create SSX or JSX that are executed everywhere on a wiki. But a bug allow anyone with edit rights to actually create those. This issue has been patched in XWiki 13.10-rc-1, 12.10.11 and 13.4.6. There\u0027s no easy workaround for this issue, administrators should upgrade their wiki."
    },
    {
      "lang": "es",
      "value": "La plataforma XWiki es una plataforma wiki gen\u00e9rica que ofrece servicios de tiempo de ejecuci\u00f3n para aplicaciones construidas sobre ella. Los usuarios simples pueden crear SSX/JSX globales sin derechos espec\u00edficos: en teor\u00eda, s\u00f3lo los usuarios con derechos de programaci\u00f3n deber\u00edan poder crear SSX o JSX que sean ejecutados en cualquier lugar de un wiki. Pero un error permite que cualquiera con derechos de edici\u00f3n pueda crearlos. Este problema ha sido parcheado en XWiki versiones 13.10-rc-1, 12.10.11 y 13.4.6. No se presenta una mitigaci\u00f3n f\u00e1cil para este problema, los administradores deben actualizar su wiki"
    }
  ],
  "id": "CVE-2022-24821",
  "lastModified": "2026-06-17T04:32:35.697",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "NONE",
          "baseScore": 5.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.0,
        "impactScore": 4.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.8,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 4.0,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.2,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2022-24821",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-04-22T15:48:58.877982Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2022-04-08T19:15:08.257",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-ghcq-472w-vf4h"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Issue Tracking",
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://jira.xwiki.org/browse/XWIKI-19155"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-ghcq-472w-vf4h"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Issue Tracking",
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://jira.xwiki.org/browse/XWIKI-19155"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-648"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-GHCQ-472W-VF4H

Vulnerability from github – Published: 2022-04-08 21:59 – Updated: 2022-04-08 21:59

Summary

Incorrect Use of Privileged APIs in org.xwiki.platform.skin.skinx

Details

Impact

Simple users can create global SSX/JSX without specific rights: in theory only users with Programming Rights should be allowed to create SSX or JSX that are executed everywhere on a wiki. But a bug allow anyone with edit rights to actually create those.

Patches

This issue has been patched in XWiki 13.10-rc-1, 12.10.11 and 13.4.6.

Workarounds

There's no easy workaround for this issue, administrators should upgrade their wiki.

References

https://jira.xwiki.org/browse/XWIKI-19155

For more information

If you have any questions or comments about this advisory: * Open an issue in JIRA * Email us at XWiki Security ML

Severity

6.8 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.xwiki.platform:xwiki-platform-skin-skinx"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "13.5.0"
            },
            {
              "fixed": "13.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.xwiki.platform:xwiki-platform-skin-skinx"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "12.10.11"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.xwiki.platform:xwiki-platform-skin-skinx"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "13.0.0"
            },
            {
              "fixed": "13.4.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-24821"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-648"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-04-08T21:59:04Z",
    "nvd_published_at": "2022-04-08T19:15:00Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nSimple users can create global SSX/JSX without specific rights: in theory only users with Programming Rights should be allowed to create SSX or JSX that are executed everywhere on a wiki. But a bug allow anyone with edit rights to actually create those. \n\n### Patches\nThis issue has been patched in XWiki 13.10-rc-1, 12.10.11 and 13.4.6. \n\n### Workarounds\nThere\u0027s no easy workaround for this issue, administrators should upgrade their wiki.\n\n### References\nhttps://jira.xwiki.org/browse/XWIKI-19155\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [JIRA](https://jira.xwiki.org)\n* Email us at [XWiki Security ML](mailto:security@xwiki.org)\n",
  "id": "GHSA-ghcq-472w-vf4h",
  "modified": "2022-04-08T21:59:04Z",
  "published": "2022-04-08T21:59:04Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-ghcq-472w-vf4h"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24821"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/xwiki/xwiki-platform"
    },
    {
      "type": "WEB",
      "url": "https://jira.xwiki.org/browse/XWIKI-19155"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Incorrect Use of Privileged APIs in org.xwiki.platform.skin.skinx"
}

GSD-2022-24821

Vulnerability from gsd - Updated: 2023-12-13 01:19

Details

Aliases

CVE-2022-24821

Aliases

CVE-2022-24821

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2022-24821",
    "description": "XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Simple users can create global SSX/JSX without specific rights: in theory only users with Programming Rights should be allowed to create SSX or JSX that are executed everywhere on a wiki. But a bug allow anyone with edit rights to actually create those. This issue has been patched in XWiki 13.10-rc-1, 12.10.11 and 13.4.6. There\u0027s no easy workaround for this issue, administrators should upgrade their wiki.",
    "id": "GSD-2022-24821"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2022-24821"
      ],
      "details": "XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Simple users can create global SSX/JSX without specific rights: in theory only users with Programming Rights should be allowed to create SSX or JSX that are executed everywhere on a wiki. But a bug allow anyone with edit rights to actually create those. This issue has been patched in XWiki 13.10-rc-1, 12.10.11 and 13.4.6. There\u0027s no easy workaround for this issue, administrators should upgrade their wiki.",
      "id": "GSD-2022-24821",
      "modified": "2023-12-13T01:19:43.544061Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security-advisories@github.com",
        "ID": "CVE-2022-24821",
        "STATE": "PUBLIC",
        "TITLE": "Incorrect Use of Privileged APIs in org.xwiki.platform.skin.skinx"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "xwiki-platform",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "\u003e 3.1M1"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "xwiki"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Simple users can create global SSX/JSX without specific rights: in theory only users with Programming Rights should be allowed to create SSX or JSX that are executed everywhere on a wiki. But a bug allow anyone with edit rights to actually create those. This issue has been patched in XWiki 13.10-rc-1, 12.10.11 and 13.4.6. There\u0027s no easy workaround for this issue, administrators should upgrade their wiki."
          }
        ]
      },
      "impact": {
        "cvss": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.8,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N",
          "version": "3.1"
        }
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "CWE-648: Incorrect Use of Privileged APIs"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-ghcq-472w-vf4h",
            "refsource": "CONFIRM",
            "url": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-ghcq-472w-vf4h"
          },
          {
            "name": "https://jira.xwiki.org/browse/XWIKI-19155",
            "refsource": "MISC",
            "url": "https://jira.xwiki.org/browse/XWIKI-19155"
          }
        ]
      },
      "source": {
        "advisory": "GHSA-ghcq-472w-vf4h",
        "discovery": "UNKNOWN"
      }
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "[13.5.0,13.10),(,12.10.11),[13.0.0,13.4.6)",
          "affected_versions": "All versions starting from 13.5.0 before 13.10, all versions before 12.10.11, all versions starting from 13.0.0 before 13.4.6",
          "cwe_ids": [
            "CWE-1035",
            "CWE-648",
            "CWE-937"
          ],
          "date": "2022-04-12",
          "description": "XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Simple users can create global SSX/JSX without specific rights: in theory only users with Programming Rights should be allowed to create SSX or JSX that are executed everywhere on a wiki. But a bug allow anyone with edit rights to actually create those. This issue has been patched in XWiki 13.10-rc-1, 12.10.11 and 13.4.6. There\u0027s no easy workaround for this issue, administrators should upgrade their wiki.",
          "fixed_versions": [
            "12.10.11"
          ],
          "identifier": "CVE-2022-24821",
          "identifiers": [
            "GHSA-ghcq-472w-vf4h",
            "CVE-2022-24821"
          ],
          "not_impacted": "All versions before 13.5.0, all versions starting from 12.10.11 before 13.10",
          "package_slug": "maven/org.xwiki.platform/xwiki-platform-skin-skinx",
          "pubdate": "2022-04-08",
          "solution": "Upgrade to version 12.10.11 or above.",
          "title": "Incorrect Use of Privileged APIs",
          "urls": [
            "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-ghcq-472w-vf4h",
            "https://nvd.nist.gov/vuln/detail/CVE-2022-24821",
            "https://jira.xwiki.org/browse/XWIKI-19155",
            "https://github.com/advisories/GHSA-ghcq-472w-vf4h"
          ],
          "uuid": "530e97c5-f960-4b25-9ab3-6c8e80e4628e"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "12.10.11",
                "versionStartIncluding": "12.0.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "13.4.6",
                "versionStartIncluding": "13.4.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:xwiki:xwiki:13.10:-:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2022-24821"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Simple users can create global SSX/JSX without specific rights: in theory only users with Programming Rights should be allowed to create SSX or JSX that are executed everywhere on a wiki. But a bug allow anyone with edit rights to actually create those. This issue has been patched in XWiki 13.10-rc-1, 12.10.11 and 13.4.6. There\u0027s no easy workaround for this issue, administrators should upgrade their wiki."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-648"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://jira.xwiki.org/browse/XWIKI-19155",
              "refsource": "MISC",
              "tags": [
                "Exploit",
                "Issue Tracking",
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://jira.xwiki.org/browse/XWIKI-19155"
            },
            {
              "name": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-ghcq-472w-vf4h",
              "refsource": "CONFIRM",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-ghcq-472w-vf4h"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "availabilityImpact": "NONE",
            "baseScore": 5.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:N",
            "version": "2.0"
          },
          "exploitabilityScore": 8.0,
          "impactScore": 4.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": false
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 5.2
        }
      },
      "lastModifiedDate": "2022-04-15T19:30Z",
      "publishedDate": "2022-04-08T19:15Z"
    }
  }
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2022-24821 (GCVE-0-2022-24821)

FKIE_CVE-2022-24821

GHSA-GHCQ-472W-VF4H

Impact

Patches

Workarounds

References

For more information

GSD-2022-24821

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour