Missing authorization in xwiki-platform

中 6.5CVE-2022-23617 · GHSA-gf7x-2j2x-7f73 · 09/02/2022 公開 · 17/06/2026 更新

要点

CVE-2022-23617 は org.xwiki.platform:xwiki-platform-oldcore, xwiki (xwiki) に影響する深刻度「中」 (CVSS 6.5) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.95%（全脆弱性の 61.1% より高い）。
対処：13.2-rc-1, 12.10.6 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
org.xwiki.platform:xwiki-platform-oldcore Maven	`≥ 13.0, < 13.2-rc-1< 12.10.6`	`13.2-rc-112.10.6`
xwiki xwiki	`= 13.0= 13.1≤ 12.10.5`	修正版なし

概要

Impact

Any user with edit right can copy the content of a page it does not have access to by using it as template of a new page.

Patches

It has been patched in XWiki 13.2CR1 and 12.10.6

Workarounds

There is no workaround beside patching.

References

https://jira.xwiki.org/browse/XWIKI-18430

For more information

If you have any questions or comments about this advisory:

Open an issue in Jira XWiki
Email us at our security mailing list

NVD の説明

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with edit right can copy the content of a page it does not have access to by using it as template of a new page. This issue has been patched in XWiki 13.2CR1 and 12.10.6. Users are advised to update. There are no known workarounds for this issue.