XWiki Platform Old Core up to 13.10.3/14.1 Template improper authentication

Summaryinfo

A vulnerability identified as critical has been detected in XWiki Platform Old Core up to 13.10.3/14.1. This affects an unknown function of the component Template Handler. Performing a manipulation results in improper authentication. This vulnerability is identified as CVE-2022-36092. The attack can be initiated remotely. There is not any exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability classified as critical has been found in XWiki Platform Old Core up to 13.10.3/14.1 (Content Management System). This affects some unknown functionality of the component Template Handler. The manipulation with an unknown input leads to a improper authentication vulnerability. CWE is classifying the issue as CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. This is going to have an impact on confidentiality. The summary by CVE is:

XWiki Platform Old Core is a core package for XWiki Platform, a generic wiki platform. Prior to versions 14.2 and 13.10.4, all rights checks that would normally prevent a user from viewing a document on a wiki can be bypassed using the login action and directly specified templates. This exposes title, content and comments of any document and properties of objects, though class and property name must be known. This is also exploitable on private wikis. This has been patched in versions 14.2 and 13.10.4 by properly checking view rights before loading documents and disallowing non-default templates in the login, registration and skin action. As a workaround, it would be possible to protect all templates individually by adding code to check access rights first.

The weakness was released 09/09/2022 as GHSA-8h89-34w2-jpfm. The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2022-36092 since 07/15/2022. Neither technical details nor an exploit are publicly available.

Upgrading to version 13.10.4 or 14.2 eliminates this vulnerability. Applying the patch 71a6d0bb6f8ab718fcfaae0e9b8c16c2d69cd4bb is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Content Management System

Name

• XWiki Platform Old Core

Version

• 13.10.0
• 13.10.1
• 13.10.2
• 13.10.3
• 14.0
• 14.1

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion