xwiki/xwiki-platform · Security
Incorrect Use of Privileged APIs in org.xwiki.platform.skin.skinx
- GHSA ID
- GHSA-ghcq-472w-vf4h
- CVE ID
- CVE-2022-24821
- Severity
- medium
- Published
- Updated
- CVSS
- 6.8 · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
- CVSS v3
- 6.8 · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
Description
Impact
Simple users can create global SSX/JSX without specific rights: in theory only users with Programming Rights should be allowed to create SSX or JSX that are executed everywhere on a wiki. But a bug allow anyone with edit rights to actually create those.
Patches
This issue has been patched in XWiki 13.10-rc-1, 12.10.11 and 13.4.6.
Workarounds
There's no easy workaround for this issue, administrators should upgrade their wiki.
References
https://jira.xwiki.org/browse/XWIKI-19155
For more information
If you have any questions or comments about this advisory:
- Open an issue in JIRA
- Email us at XWiki Security ML
CWEs
- CWE-648 · Incorrect Use of Privileged APIs