PT-2022-16129

CVE-2022-23616

·

Published

2022-02-09

·

Updated

2022-02-15

Description by

CVSS 3.1
8.8
High
MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions XWiki Platform versions prior to 13.1RC1
Description The issue allows an unprivileged user to perform a remote code execution by injecting a groovy script in her own profile and by calling the Reset password feature, as it performs a save of the user profile with programming rights.
Recommendations For versions prior to 13.1RC1, consider the following workarounds:
  1. The Reset password feature can be entirely disabled by deleting the XWiki/ResetPassword page.
  2. The script in XWiki/ResetPassword can also be modified or removed: an administrator can replace it with a simple email contact to ask an administrator to reset the password.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\'Injection\')
Related identifiers
CVE-2022-23616
GHSA-MGJW-2WRP-R535
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com