CVE-2022-41930
CVSS V2 None
CVSS V3 None
Description
org.xwiki.platform:xwiki-platform-user-profile-ui is missing authorization to enable or disable users. Any user (logged in or not) with access to the page XWiki.XWikiUserProfileSheet can enable or disable any user profile. This might allow to a disabled user to re-enable themselves, or to an attacker to disable any user of the wiki. The problem has been patched in XWiki 13.10.7, 14.5RC1 and 14.4.2. Workarounds: The problem can be patched immediately by editing the page `XWiki.XWikiUserProfileSheet` in the wiki and by performing the changes contained in https://github.com/xwiki/xwiki-platform/commit/5be1cc0adf917bf10899c47723fa451e950271fa.
Overview
- CVE ID
- CVE-2022-41930
- Assigner
- security-advisories@github.com
- Vulnerability Status
- Analyzed
- Published Version
- 2022-11-23T19:15:12
- Last Modified Date
- 2022-11-30T16:50:46
Weakness Enumerations
CPE Configuration (Product)
| CPE | Vulnerable | Operator | Version Start | Version End |
|---|---|---|---|---|
| cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:* | 1 | OR | 12.4 | 13.10.7 |
| cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:* | 1 | OR | 14.0.0 | 14.4.2 |
| cpe:2.3:a:xwiki:xwiki:14.4.3:*:*:*:*:*:*:* | 1 | OR | ||
| cpe:2.3:a:xwiki:xwiki:14.4.4:*:*:*:*:*:*:* | 1 | OR |
Sources
| Source Name | Source URL |
|---|---|
| NIST | https://nvd.nist.gov/vuln/detail/CVE-2022-41930 |
| MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41930 |
History
| Created | Old Value | New Value | Data Type | Notes |
|---|---|---|---|---|
| 2022-11-23 20:00:18 | Added to TrackCVE | |||
| 2022-12-07 18:02:25 | 2022-11-23T19:15Z | 2022-11-23T19:15:12 | CVE Published Date | updated |
| 2022-12-07 18:02:25 | 2022-11-30T16:50:46 | CVE Modified Date | updated | |
| 2022-12-07 18:02:25 | Analyzed | Vulnerability Status | updated | |
| 2022-12-07 18:02:27 | CPE Information | updated |