GHSA-4x5r-6v26-7j4v

Source

https://github.com/advisories/GHSA-4x5r-6v26-7j4v

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/11/GHSA-4x5r-6v26-7j4v/GHSA-4x5r-6v26-7j4v.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-4x5r-6v26-7j4v

Aliases

CVE-2022-41932

Published

2022-11-21T22:36:49Z

Modified

2023-11-08T04:10:36.303578Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

Creation of new database tables through login form on PostgreSQL

Details

Impact

It's possible to make XWiki create many new schemas and fill them with tables just by using a crafted user identifier in the login form.

Patches

The problem has been patched in XWiki 13.10.8, 14.6RC1 and 14.4.2.

Workarounds

The only workarounds for this are: * use an authenticator which does interpret the login as a reference to a document * using a different database than PostgreSQL * upgrade XWiki

References

https://jira.xwiki.org/browse/XWIKI-19886

For more information

If you have any questions or comments about this advisory: * Open an issue in Jira XWiki.org * Email us at Security Mailing List

Database specific

{
    "nvd_published_at": "2022-11-23T21:15:00Z",
    "cwe_ids": [
        "CWE-400",
        "CWE-770"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2022-11-21T22:36:49Z"
}

References

Affected packages

Maven / org.xwiki.platform:xwiki-platform-oldcore

Package

Name: org.xwiki.platform:xwiki-platform-oldcore; View open source insights on deps.dev
Purl: pkg:maven/org.xwiki.platform/xwiki-platform-oldcore

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

13.10.8

Maven / org.xwiki.platform:xwiki-platform-oldcore

Package

Name: org.xwiki.platform:xwiki-platform-oldcore; View open source insights on deps.dev
Purl: pkg:maven/org.xwiki.platform/xwiki-platform-oldcore

Affected ranges

Type: ECOSYSTEM
Events: Introduced

14.0.0

Fixed

14.4.2

Maven / org.xwiki.platform:xwiki-platform-oldcore

Package

Name: org.xwiki.platform:xwiki-platform-oldcore; View open source insights on deps.dev
Purl: pkg:maven/org.xwiki.platform/xwiki-platform-oldcore

Affected ranges

Type: ECOSYSTEM
Events: Introduced

14.5.0

Fixed

14.6-rc-1