CVE-2022-23621

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-23621
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-23621.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-23621
Aliases
Published
2022-02-09T21:25:11Z
Modified
2026-10-24T14:31:45Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H CVSS Calculator
Summary
Missing authorization in xwiki-platform
Details

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with SCRIPT right can read any file located in the XWiki WAR (for example xwiki.cfg and xwiki.properties) through XWiki#invokeServletAndReturnAsString as $xwiki.invokeServletAndReturnAsString("/WEB-INF/xwiki.cfg"). This issue has been patched in XWiki versions 12.10.9, 13.4.3 and 13.7-rc-1. Users are advised to update. The only workaround is to limit SCRIPT right.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-862"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23621.json"
}
References

Affected packages

Git / github.com/xwiki/xwiki-commons

Affected ranges

Type
GIT
Repo
https://github.com/xwiki/xwiki-commons
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
498d9c5b0098754a675e402e51361367db4c7c9c
Introduced
427c24372a3f8de165dedf1c257e8e3829e080c7
Fixed
2af5ac4cf9cebfc79788ba984e10dc1d06470556
Introduced
48e84afcd78dddb228a53067132edcaace7c65d2
Last Affected
2636e39e722f1457e81a316a00526abffcc98d45
Database specific
Show details 
{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "12.10.9"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "13.4"
                },
                {
                    "fixed":  "13.4.3"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "13.4.4"
                },
                {
                    "last_affected":  "13.7"
                }
            ],
            "source":  "CPE_RANGE"
        }
    ]
}
Type
GIT
Repo
https://github.com/xwiki/xwiki-platform
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
212f09c83623bb170b0ab897c976d39f8abb0e31
Introduced
e96ff4c0aa5072590b0a876a7de5003e6a891e47
Fixed
f9533eeb3ac5b9cc18e37e25c3bb289bc7bc6193
Introduced
ac12f8e2f29d301d4dcd677381c24b864fa1544b
Fixed
df8bd49b5a4d87a427002c6535fb5b1746ff117a
Database specific
Show details 
{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "12.10.9"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "13.4"
                },
                {
                    "fixed":  "13.4.3"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "13.4.4"
                },
                {
                    "last_affected":  "13.7"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "range":  [
                {
                    "fixed":  "df8bd49b5a4d87a427002c6535fb5b1746ff117a"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

xwiki-commons-12.*
xwiki-commons-12.10
xwiki-commons-12.10.1
xwiki-commons-12.10.2
xwiki-commons-12.10.3
xwiki-commons-12.10.4
xwiki-commons-12.10.5
xwiki-commons-12.10.6
xwiki-commons-12.10.7
xwiki-commons-12.10.8
xwiki-commons-13.*
xwiki-commons-13.4
xwiki-commons-13.4.1
xwiki-commons-13.4.2
xwiki-commons-13.7
xwiki-commons-13.7-rc-1
xwiki-commons-8.*
xwiki-commons-8.0-milestone-1
xwiki-commons-8.0-milestone-2
xwiki-commons-8.1-milestone-1
xwiki-commons-8.1-milestone-2
xwiki-commons-8.2-milestone-1
xwiki-commons-8.2-milestone-2
xwiki-commons-8.3-milestone-1
xwiki-commons-8.3-milestone-2
xwiki-platform-12.*
xwiki-platform-12.10
xwiki-platform-12.10.1
xwiki-platform-12.10.2
xwiki-platform-12.10.3
xwiki-platform-12.10.4
xwiki-platform-12.10.5
xwiki-platform-12.10.6
xwiki-platform-12.10.7
xwiki-platform-12.10.8
xwiki-platform-13.*
xwiki-platform-13.4
xwiki-platform-13.4.1
xwiki-platform-13.4.2
xwiki-platform-7.*
xwiki-platform-7.3-milestone-2
xwiki-platform-7.4-milestone-1
xwiki-platform-7.4-milestone-2
xwiki-platform-8.*
xwiki-platform-8.0-milestone-1
xwiki-platform-8.0-milestone-2
xwiki-platform-8.1-milestone-1
xwiki-platform-8.1-milestone-2
xwiki-platform-8.2-milestone-1
xwiki-platform-8.2-milestone-2
xwiki-platform-8.3-milestone-1
xwiki-platform-9.*
xwiki-platform-9.9-rc-2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-23621.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "312735897479458807391540801967798482192",
                "288540640851196478397814797030605779298",
                "207615600172929574598666783583097132668",
                "189548784275655133077180018242399575151",
                "44909460929864241674364482150015235638",
                "3290161762828059693328281462853358647",
                "310184185500440019218780499755935875925",
                "213734655900568494201808825804160032542",
                "264334325072214292464630722879088169038",
                "41202067934689620456874653839621186544",
                "316858996173030048806321253285824776340",
                "78203600794019819186239343392405163690",
                "62142681166650348837374197389525470250",
                "143417270559226954621299233449701361133",
                "62465368041667356164272499767703606676",
                "327616427435342513849366077418468608780",
                "129387923336302803555474060756569645849",
                "56606373469797819418082253693990875100",
                "54134763038435541220464723341844105130",
                "96854081116692822803023502766826007750",
                "228095990763410698448970426733766551370",
                "139332060865633223781969421220660697005",
                "323381034331915400045266056863617085858"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2022-23621-7f8c2c98",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/xwiki/xwiki-platform/commit/df8bd49b5a4d87a427002c6535fb5b1746ff117a",
        "target":  {
            "file":  "xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/XWiki.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "234276073509469624203755440520741318351",
                "44584423755903519574830026123585854072",
                "102657509338869881264397836905993677036",
                "241973162086491505416357681560334156310",
                "52133322952623813513076419376037087579",
                "123203578948503229588971717640322396768",
                "39827609826680343926315031712147164516"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2022-23621-c0d69169",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/xwiki/xwiki-platform/commit/df8bd49b5a4d87a427002c6535fb5b1746ff117a",
        "target":  {
            "file":  "xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/api/XWiki.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "44377995968361951554719057961784599202",
            "length":  353
        },
        "id":  "CVE-2022-23621-f942922c",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/xwiki/xwiki-platform/commit/df8bd49b5a4d87a427002c6535fb5b1746ff117a",
        "target":  {
            "file":  "xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/XWiki.java",
            "function":  "invokeServletAndReturnAsString"
        }
    }
]
vanir_signatures_modified 
"2026-10-24T14:31:45Z"