GHSA-h5j3-5x63-p8jv

Suggest an improvement
Source
https://github.com/advisories/GHSA-h5j3-5x63-p8jv
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/09/GHSA-h5j3-5x63-p8jv/GHSA-h5j3-5x63-p8jv.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-h5j3-5x63-p8jv
Aliases
Published
2022-09-16T17:05:55Z
Modified
2023-11-08T04:10:00Z
Severity
  • 8.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N CVSS Calculator
Summary
XWiki Platform Web Templates vulnerable to Unauthorized User Registration Through the Distribution Wizard
Details

Impact

By passing a template of the distribution wizard to the xpart template, user accounts can be created even when user registration is disabled. This also circumvents any email verification. Before versions 14.2 and 13.10.4, this can also be exploited on a private wiki, thus potentially giving the attacker access to the wiki. Depending on the configured default rights of users, this could also give attackers write access to an otherwise read-only public wiki. Users can also be created when an external authentication system like LDAP is configured, but authentication fails unless the authentication system supports a bypass/local accounts are enabled in addition to the external authentication system.

Patches

This issue has been patched in XWiki 13.10.5 and 14.3RC1.

Workarounds

It is possible to replace xpart.vm, the entry point for this attack, by a patched version from the patch without updating XWiki.

References

For more information

If you have any questions or comments about this advisory:

Database specific 
{
    "cwe_ids":  [
        "CWE-287",
        "CWE-288"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2022-09-16T17:05:55Z",
    "nvd_published_at":  "2022-09-08T18:15:00Z",
    "severity":  "HIGH"
}
References

Affected packages

Maven
org.xwiki.platform:xwiki-platform-web-templates

Package

Name
org.xwiki.platform:xwiki-platform-web-templates
View open source insights on deps.dev
Purl
pkg:maven/org.xwiki.platform/xwiki-platform-web-templates

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
13.10.5

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/09/GHSA-h5j3-5x63-p8jv/GHSA-h5j3-5x63-p8jv.json"
org.xwiki.platform:xwiki-platform-web

Package

Name
org.xwiki.platform:xwiki-platform-web
View open source insights on deps.dev
Purl
pkg:maven/org.xwiki.platform/xwiki-platform-web

Affected ranges

Type
ECOSYSTEM
Events
Introduced
8.0-rc-1
Fixed
13.10.5

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/09/GHSA-h5j3-5x63-p8jv/GHSA-h5j3-5x63-p8jv.json"
org.xwiki.platform:xwiki-platform-web-templates

Package

Name
org.xwiki.platform:xwiki-platform-web-templates
View open source insights on deps.dev
Purl
pkg:maven/org.xwiki.platform/xwiki-platform-web-templates

Affected ranges

Type
ECOSYSTEM
Events
Introduced
14.0
Fixed
14.3-rc-1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/09/GHSA-h5j3-5x63-p8jv/GHSA-h5j3-5x63-p8jv.json"
org.xwiki.platform:xwiki-platform-web

Package

Name
org.xwiki.platform:xwiki-platform-web
View open source insights on deps.dev
Purl
pkg:maven/org.xwiki.platform/xwiki-platform-web

Affected ranges

Type
ECOSYSTEM
Events
Introduced
14.0
Fixed
14.3-rc-1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/09/GHSA-h5j3-5x63-p8jv/GHSA-h5j3-5x63-p8jv.json"