XWiki Platform Old Core XWikiRights Resolution privileges management

Summaryinfo

A vulnerability was found in XWiki Platform Old Core and classified as critical. Affected by this issue is some unknown functionality of the component XWikiRights Resolution. The manipulation results in privileges management. This vulnerability is cataloged as CVE-2022-31166. The attack may be launched remotely. There is no exploit available. It is advisable to implement a patch to correct this issue.

Detailsinfo

A vulnerability classified as critical has been found in XWiki Platform Old Core (Content Management System) (the affected version is unknown). Affected is an unknown code of the component XWikiRights Resolution. The manipulation with an unknown input leads to a privileges management vulnerability. CWE is classifying the issue as CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

XWiki Platform Old Core is a core package for XWiki Platform, a generic wiki platform. Starting in versions 11.3.7, 11.0.3, and 12.0RC1, it is possible to exploit a bug in XWikiRights resolution of groups to obtain privilege escalation. More specifically, editing a right with the object editor leads to adding a supplementary empty value to groups which is then resolved as a reference to XWiki.WebHome page. Adding an XWikiGroup xobject to that page then transforms it to a group, any user put in that group would then obtain the privileges related to the edited right. Note that this security issue is normally mitigated by the fact that XWiki.WebHome (and XWiki space in general) should be protected by default for edit rights. The problem has been patched in XWiki 13.10.4 and 14.2RC1 to not consider anymore empty values in XWikiRights. It's possible to work around the problem by setting appropriate rights on XWiki.WebHome page to prevent users to edit it.

The weakness was shared 09/07/2022 as GHSA-g4h6-qp44-wqvx. The advisory is shared for download at github.com. This vulnerability is traded as CVE-2022-31166 since 05/18/2022. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1068.

Applying a patch is able to eliminate this problem. The bugfix is ready for download at github.com.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Content Management System

Name

• XWiki Platform Old Core

License

• open-source

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion