CVE-2022-41937 json
Missing Authorization in XWiki Platform
published 2022-11-21 3 y ago modified 2026-06-17 4 mo ago also GHSA-q6jp-gcww-8v2j , EUVD-2022-7409
- cvss
- 9.6
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.8%
- EPSS 0.8% chance of exploitation in 30 days, percentile 57%
- public exploits
- 0
- none known
Summary
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The application allows anyone with view access to modify any page of the wiki by importing a crafted XAR package. The problem has been patched in XWiki 14.6RC1, 14.6 and 13.10.8. As a workaround, setting the right of the page Filter.WebHome and making sure only the main wiki administrators can view the application installed on main wiki or edit the page and apply the changed described in commit fb49b4f.
Patch / fix
- maven org.xwiki.platform:xwiki-platform-filter-ui 13.10.8, 14.4.3, 14.6-rc-1
- xwiki xwiki 13.10.8, 14.4.3
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 18 mo ago
Exploit prediction
0.82% chance of exploitation in the next 30 days, higher than 57% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.6 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N |
| NVD | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
| GitHub | 3.1 | 9.6 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.xwiki.platform:xwiki-platform-filter-ui | <13.10.8 >=14.0.0, <14.4.3 >=14.5.0, <14.6-rc-1 |
13.10.8 14.4.3 14.6-rc-1 |
Affected products
- xwiki xwiki-platform
Classification
- Weakness
-
- CWE-862 Missing Authorization
References
-
github.com
/xwiki/xwiki-platform/commit/fb49b4f289ee28e45cfada8e97e320cd3ed27113
web, patch, third-party-advisory
-
github.com
/xwiki/xwiki-platform/security/advisories/GHSA-q6jp-gcww-8v2j
web, patch, third-party-advisory
-
jira.xwiki.org
/browse/XWIKI-19758
web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2022-41937
advisory
-
github.com
/xwiki/xwiki-platform
package
Sources
- CVE List CVE-2022-41937
- GitHub Advisory GHSA-q6jp-gcww-8v2j
- NVD CVE-2022-41937
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.