CVE-2022-41929

Missing Authorization in User#setDisabledStatus in org.xwiki.platform:xwiki-platform-oldcore

CVSS 4.9 MEDIUMEPSS 0.7%CWE-862

Vexday Risk Score

13Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 4.9EPSS 0.7%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

23 Nov 2022Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

org.xwiki.platform:xwiki-platform-oldcore is missing authorization in User#setDisabledStatus, which may allow an incorrectly authorized user with only Script rights to enable or disable a user. This operation is meant to only be available for users with admin rights. This problem has been patched in XWiki 13.10.7, 14.4.2 and 14.5RC1.

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Affected products

xwiki · xwiki-platform

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/xwiki/xwiki-platform/commit/0b732f2ef0224e2aaf10e2e1ef48dbd3fb6e10cd https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-2gj2-vj98-j2qq https://jira.xwiki.org/browse/XWIKI-19804