4.9

CVE-2022-41929

Exploit

org.xwiki.platform:xwiki-platform-oldcore is missing authorization in User#setDisabledStatus, which may allow an incorrectly authorized user with only Script rights to enable or disable a user. This operation is meant to only be available for users with admin rights. This problem has been patched in XWiki 13.10.7, 14.4.2 and 14.5RC1.

Data is provided by the National Vulnerability Database (NVD)
Xwiki ≫ Xwiki Version > 11.7 < 13.10.7
Xwiki ≫ Xwiki Version > 14.0.0 < 14.4.2
Xwiki ≫ Xwiki Version11.7 Updaterc1
Xwiki ≫ Xwiki Version14.4.3
Xwiki ≫ Xwiki Version14.4.4
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.25% 0.478
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 4.9 1.2 3.6
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
security-advisories@github.com 4.9 1.2 3.6
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
CWE-862 Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

https://jira.xwiki.org/browse/XWIKI-19804
Patch
Vendor Advisory
Exploit
Issue Tracking