CVE-2022-41929

org.xwiki.platform:xwiki-platform-oldcore is missing authorization in User#setDisabledStatus, which may allow an incorrectly authorized user with only Script rights to enable or disable a user. This operation is meant to only be available for users with admin rights. This problem has been patched in XWiki 13.10.7, 14.4.2 and 14.5RC1.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
4.9 MEDIUM
NETWORK
LOW
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
GitHub_MCNA
4.9 MEDIUM
NETWORK
LOW
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
CVEADP
---
---
CISA-ADPADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 42%
VendorProductVersion
xwikixwiki
11.7 <
𝑥
< 13.10.7
xwikixwiki
14.0.0 <
𝑥
< 14.4.2
xwikixwiki
11.7:rc1
xwikixwiki
14.4.3
xwikixwiki
14.4.4
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/xwiki/xwiki-platform/commit/0b732f2ef0224e2aaf10e2e1ef48dbd3fb6e10cd
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-2gj2-vj98-j2qq
https://jira.xwiki.org/browse/XWIKI-19804
https://github.com/xwiki/xwiki-platform/commit/0b732f2ef0224e2aaf10e2e1ef48dbd3fb6e10cd
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-2gj2-vj98-j2qq
https://jira.xwiki.org/browse/XWIKI-19804