Missing authorization in xwiki-platform

TRUNG BÌNH 6.5CVE-2022-23617 · GHSA-gf7x-2j2x-7f73 · Công bố 09/02/2022 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2022-23617 là lỗ hổng mức TRUNG BÌNH (CVSS 6.5) ảnh hưởng org.xwiki.platform:xwiki-platform-oldcore, xwiki (xwiki).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.95%, cao hơn 61.1% các lỗ hổng khác.
Cách xử lý: cập nhật lên 13.2-rc-1, 12.10.6 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
org.xwiki.platform:xwiki-platform-oldcore Maven	`≥ 13.0, < 13.2-rc-1< 12.10.6`	`13.2-rc-112.10.6`
xwiki xwiki	`= 13.0= 13.1≤ 12.10.5`	Chưa có bản vá

Mô tả

Impact

Any user with edit right can copy the content of a page it does not have access to by using it as template of a new page.

Patches

It has been patched in XWiki 13.2CR1 and 12.10.6

Workarounds

There is no workaround beside patching.

References

https://jira.xwiki.org/browse/XWIKI-18430

For more information

If you have any questions or comments about this advisory:

Open an issue in Jira XWiki
Email us at our security mailing list

Mô tả của NVD

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with edit right can copy the content of a page it does not have access to by using it as template of a new page. This issue has been patched in XWiki 13.2CR1 and 12.10.6. Users are advised to update. There are no known workarounds for this issue.