CVSS: 8.1EPSS: 0%CPEs: 3EXPL: 1CVE-2022-24821 – Incorrect Use of Privileged APIs in org.xwiki.platform.skin.skinx
https://notcve.org/view.php?id=CVE-2022-24821
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Simple users can create global SSX/JSX without specific rights: in theory only users with Programming Rights should be allowed to create SSX or JSX that are executed everywhere on a wiki. But a bug allow anyone with edit rights to actually create those. This issue has been patched in XWiki 13.10-rc-1, 12.10.11 and 13.4.6. There's no easy workaround for this issue, administrators should upgrade their wiki. • https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-ghcq-472w-vf4h https://jira.xwiki.org/browse/XWIKI-19155 • CWE-648: Incorrect Use of Privileged APIs •
CVSS: 7.4EPSS: 0%CPEs: 6EXPL: 0CVE-2022-23622 – Cross site scripting in registration template in xwiki-platform
https://notcve.org/view.php?id=CVE-2022-23622
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions there is a cross site scripting (XSS) vector in the `registerinline.vm` template related to the `xredirect` hidden field. This template is only used in the following conditions: 1. The wiki must be open to registration for anyone. 2. The wiki must be closed to view for Guest users or more specifically the XWiki.Registration page must be forbidden in View for guest user. • https://github.com/xwiki/xwiki-platform/commit/053d957d53f2a543d158f3ab651e390d2728e0b9 https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-gx6h-936c-vrrr https://jira.xwiki.org/browse/XWIKI-19291 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2022-23621 – Missing authorization in xwiki-platform
https://notcve.org/view.php?id=CVE-2022-23621
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with SCRIPT right can read any file located in the XWiki WAR (for example xwiki.cfg and xwiki.properties) through XWiki#invokeServletAndReturnAsString as `$xwiki.invokeServletAndReturnAsString("/WEB-INF/xwiki.cfg")`. This issue has been patched in XWiki versions 12.10.9, 13.4.3 and 13.7-rc-1. Users are advised to update. The only workaround is to limit SCRIPT right. • https://github.com/xwiki/xwiki-platform/commit/df8bd49b5a4d87a427002c6535fb5b1746ff117a https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-2jhm-qp48-hv5j https://jira.xwiki.org/browse/XWIKI-18870 • CWE-552: Files or Directories Accessible to External Parties CWE-862: Missing Authorization •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-23620 – Path traversal in xwiki-platform-skin-skinx
https://notcve.org/view.php?id=CVE-2022-23620
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions AbstractSxExportURLFactoryActionHandler#processSx does not escape anything from SSX document references when serializing it on filesystem, it is possible to for the HTML export process to contain reference elements containing filesystem syntax like "../", "./". or "/" in general. The referenced elements are not properly escaped. This issue has been resolved in version 13.6-rc-1. This issue can be worked around by limiting or disabling document export. • https://github.com/xwiki/xwiki-platform/commit/ab778254fb8f71c774e1c1239368c44fe3b6bba5 https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-7ph6-5cmq-xgjq https://jira.xwiki.org/browse/XWIKI-18819 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-116: Improper Encoding or Escaping of Output •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2022-23619 – Information exposure in xwiki-platform
https://notcve.org/view.php?id=CVE-2022-23619
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible to guess if a user has an account on the wiki by using the "Forgot your password" form, even if the wiki is closed to guest users. This problem has been patched on XWiki 12.10.9, 13.4.1 and 13.6RC1. Users are advised yo update. There are no known workarounds for this issue. • https://github.com/xwiki/xwiki-platform/commit/d8a3cce48e0ac1a0f4a3cea7a19747382d9c9494 https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-35fg-hjcr-j65f https://jira.xwiki.org/browse/XWIKI-18787 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-640: Weak Password Recovery Mechanism for Forgotten Password •