CVSS 3.1
8.1 highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:NCVE-2022-24821
High (8.1) in xwiki xwiki. EPSS 0.8% chance of exploitation in the next 30 days. Fixed in org.xwiki.platform:xwiki-platform-skin-skinx 12.10.11, 13.10, 13.4.6.
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Simple users can create global SSX/JSX without specific rights: in theory only users with Programming Rights should be allowed to create SSX or JSX that are executed everywhere on a wiki. But a bug allow anyone with edit rights to actually create those. This issue has been patched in XWiki 13.10-rc-1, 12.10.11 and 13.4.6. There's no easy workaround for this issue, administrators should upgrade their wiki.
Severity
- EPSS
- 0.8% chance of exploitation in the next 30 days; higher than 56% of CVEs (scores of 2026-11-01)
- CWE
- CWE-648
- Published
- Modified
- Record from
- the NVD, synced
Affected
- xwiki:xwiki
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-ghcq-472w-vf4h | Maven | org.xwiki.platform:xwiki-platform-skin-skinx | >=13.5.0 <13.10 | 13.10 |
| GHSA-ghcq-472w-vf4h | Maven | org.xwiki.platform:xwiki-platform-skin-skinx | <12.10.11 | 12.10.11 |
| GHSA-ghcq-472w-vf4h | Maven | org.xwiki.platform:xwiki-platform-skin-skinx | >=13.0.0 <13.4.6 | 13.4.6 |