CVE-2022-36090 json
org.xwiki.platform:xwiki-platform-oldcore Improper Authorization check for inactive users
published 2022-09-08 4 y ago modified 2026-06-17 4 mo ago also GHSA-jgc8-gvcx-9vfx , EUVD-2022-6854
- cvss
- 8.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.2%
- EPSS 1.2% chance of exploitation in 30 days, percentile 68%
- public exploits
- 0
- none known
Summary
XWiki Platform Old Core is a core package for XWiki Platform, a generic wiki platform. Prior to versions 13.1.0.5 and 14.3-rc-1, some resources are missing a check for inactive (not yet activated or disabled) users in XWiki, including the REST service. This means a disabled user can enable themselves using a REST call. On the same way some resources handler created by extensions are not protected by default, so an inactive user could perform actions for such extensions. This issue has existed since at least version 1.1 of XWiki for instance configured with the email activation required for new users. Now it's more critical for versions 11.3-rc-1 and later since the maintainers provided the capability to disable user without deleting them and encouraged using that feature. XWiki 14.3-rc-1 and XWiki 13.10.5 contain a patch. There is no workaround for this other than upgrading XWiki.
Patch / fix
- maven org.xwiki.platform:xwiki-platform-oldcore 13.10.5, 14.3-rc-1
- xwiki xwiki 13.10.5
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- total
- Assessed
- 18 mo ago
Exploit prediction
1.19% chance of exploitation in the next 30 days, higher than 68% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- jira.xwiki.org https://jira.xwiki.org/browse/XWIKI-19559 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
| NVD | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
| GitHub | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.xwiki.platform:xwiki-platform-oldcore | >=1.1, <13.10.5 >=14.0, <14.3-rc-1 |
13.10.5 14.3-rc-1 |
Affected products
- xwiki xwiki-platform
Classification
- Weakness
-
- CWE-285 Improper Authorization
References
-
github.com
/xwiki/xwiki-platform/commit/e074d226d9b2b96a0a1ba4349d1b73a802842986
web, patch, third-party-advisory
-
jira.xwiki.org
/browse/XWIKI-19559
web, exploit, vendor-advisory
-
github.com
/xwiki/xwiki-platform/security/advisories/GHSA-jgc8-gvcx-9vfx
web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2022-36090
advisory
-
github.com
/xwiki/xwiki-platform
package
Sources
- CVE List CVE-2022-36090
- GitHub Advisory GHSA-jgc8-gvcx-9vfx
- NVD CVE-2022-36090
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.