Iniciar sesión
Deutsch English Español Polski
Alta

XWiki.WebHome vulnerable to Improper Privilege Management in XWiki resolving groups

  • Publicada: 20.09.2022
  • Actualizado: 11.10.2026 11:21

Impact

It's possible to exploit a bug in XWikiRights resolution of groups to obtain privilege escalation.

More specifically, editing a right with the object editor leads to adding a supplementary empty value to groups which is then resolved as a reference to XWiki.WebHome page. Adding an XWikiGroup xobject to that page then transforms it to a group, any user put in that group would then obtain the privileges related to the edited right.

Note that this security issue is normally mitigated by the fact that XWiki.WebHome (and XWiki space in general) should be protected by default for edit rights.

Patches

The problem has been patched in XWiki 13.10.4 and 14.2RC1 to not consider anymore empty values in XWikiRights.

Workarounds

It's possible to workaround the problem by setting appropriate rights on XWiki.WebHome page to prevent users to edit it.

References

For more information

If you have any questions or comments about this advisory:

Software afectado

Haz clic en una tecnología para ver todas sus vulnerabilidades.

PlataformaPaqueteVersiones vulnerablesCorregida en
Java / Kotlin (Maven) org.xwiki.platform:xwiki-platform-oldcore >= 11.3.7, < 13.10.4, >= 14.0-rc-1, < 14.2-rc-1 13.10.4, 14.2-rc-1

Referencias

Puntuación CVSS 8.1/10
Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Debilidad (CWE)
CWE-269
Plataforma
Java / Kotlin (Maven)
Paquete
org.xwiki.platform:xwiki-platform-oldcore
Publicada
20.09.2022
Actualizado
11.10.2026 11:21

Fuentes y licencias

OSV / GitHub Advisory Database - GHSA-g4h6-qp44-wqvx - CC BY 4.0

Historial de vulnerabilidades: org.xwiki.platform:xwiki-platform-oldcore

Todas las vulnerabilidades publicadas de este paquete (Java / Kotlin (Maven)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.

Todas (46) en el archivo
Entradas en total
46
Primera → última
09.2020 07.2026
Sin corrección
0
Explotada en ataques
0

Distribución por gravedad

  • Crítica 12
  • Alta 17
  • Media 15
  • Baja 2

Divulgaciones por año

Gravedad:
  1. XWiki.WebHome vulnerable to Improper Privilege Management in XWiki resolving groups esta entrada
    Alta · 8.1 CVE-2022-31166 >= 11.3.7, < 13.10.4, >= 14.0-rc-1, < 14.2-rc-1 13.10.4, 14.2-rc-1
  2. XWiki Platform Old Core: Resource path traversal via /skin/ action endpoint in Jetty 12+
    Alta CVE-2026-34151 < 17.10.5, >= 18.0.0-rc-1, < 18.2.0 17.10.5, 18.2.0
  3. XWiki vulnerable to remote code execution with script right through unprotected Velocity scripting API
    Alta CVE-2026-33229 >= 17.0.0-rc-1, < 17.4.8, >= 17.5.0-rc-1, < 17.10.1 17.4.8, 17.10.1
  4. XWiki exposes passwords and emails stored in fields not named password/email in xml.vm
    Alta CVE-2025-54125 >= 1.1, < 16.4.7, >= 16.5.0-rc-1, < 16.10.5, >= 17.0.0-rc-1, < 17.2.0-rc-1 16.4.7, 16.10.5, 17.2.0-rc-1
  5. XWiki leaks password hashes and other accessible password properties
    Alta CVE-2025-54124 >= 9.8-rc-1, < 16.4.7, >= 16.5.0-rc-1, < 16.10.5, >= 17.0.0-rc-1, < 17.2.0-rc-1 16.4.7, 16.10.5, 17.2.0-rc-1
  6. XWiki Platform vulnerable to SQL injection through XWiki#searchDocuments API
    Alta CVE-2025-54385 >= 1.0, < 16.10.6, >= 17.0.0-rc1, < 17.3.0-rc-1 16.10.6, 17.3.0-rc-1
  7. XWiki allows remote code execution through preview of XClass changes in AWM editor
    Alta CVE-2025-49586 >= 7.2-milestone-2, < 16.4.7, >= 16.5.0-rc-1, < 16.10.3, >= 17.0.0-rc-1, < 17.0.0 16.4.7, 16.10.3, 17.0.0
  8. XWiki allows SQL injection in query endpoint of REST API with Oracle
    Crítica CVE-2024-56158 >= 1.0, < 15.10.16, >= 16.0.0-rc-1, < 16.4.7, >= 16.5.0-rc-1, < 16.10.2 15.10.16, 16.4.7, 16.10.2
  9. org.xwiki.platform:xwiki-platform-oldcore allows SQL injection in short form select requests through the script query API
    Alta CVE-2025-32968 >= 1.6-milestone-1, < 15.10.16, >= 16.0.0-rc-1, < 16.4.6, >= 16.5.0-rc-1, < 16.10.1 15.10.16, 16.4.6, 16.10.1
  10. XWiki Platform allows XSS through XClass name in string properties
    Crítica · 9.0 CVE-2024-43400 >= 1.1.2, < 14.10.21, >= 15.0-rc-1, < 15.5.5, >= 15.6-rc-1, < 15.10.6, >= 16.0.0-rc-1, < 16.0.0 14.10.21, 15.5.5, 15.10.6, 16.0.0
  11. XWiki Platform allows remote code execution from user account
    Crítica · 9.0 CVE-2024-37899 >= 13.4.7, < 14.10.21, >= 13.10.3, < 14.10.21, >= 15.0-rc-1, < 15.5.5, >= 15.6-rc-1, < 15.10.6, >= 16.0.0-rc-1, < 16.0.0 14.10.21, 15.5.5, 15.10.6, 16.0.0
  12. XWiki Platform remote code execution from account via custom skins support
    Crítica · 9.9 CVE-2024-31987 >= 6.4-milestone-1, < 14.10.19, >= 15.0-rc-1, < 15.5.4, >= 15.6-rc-1, < 15.10-rc-1 14.10.19, 15.5.4, 15.10-rc-1
  13. XWiki Platform: Privilege escalation (PR) from user registration through PDFClass
    Crítica · 9.9 CVE-2024-31981 >= 3.0.1, < 14.10.20, >= 15.0-rc-1, < 15.5.4, >= 15.6-rc-1, < 15.10-rc-1 14.10.20, 15.5.4, 15.10-rc-1
  14. XWiki has no right protection on rollback action
    Alta · 8.0 CVE-2024-21648 >= 1.0, < 14.10.17 14.10.17
  15. XWiki Platform vulnerable to privilege escalation and remote code execution via the edit action
    Alta · 8.8 CVE-2023-46243 >= 15.0, < 15.2-rc-1, >= 1.0, < 14.10.6 15.2-rc-1, 14.10.6
  16. XWiki Platform vulnerable to remote code execution via the edit action because it lacks CSRF token
    Crítica · 9.6 CVE-2023-46242 >= 1.0, < 14.10.7, >= 15.0, < 15.2-rc-1 14.10.7, 15.2-rc-1
  17. XWiki Platform vulnerable to CSRF privilege escalation/RCE via the create action
    Alta · 8.0 CVE-2023-40572 >= 3.2-milestone-3, < 14.10.9, >= 15.0-rc-1, < 15.4-rc-1 14.10.9, 15.4-rc-1
  18. Upgrading doesn't prevent exploiting vulnerable XWiki documents
    Crítica · 9.9 CVE-2023-36468 >= 2.0, < 14.10.7, >= 15.0-rc-1, < 15.2-rc-1 14.10.7, 15.2-rc-1
  19. XWiki Platform vulnerable to reflected cross-site scripting via delattachment action
    Alta · 8.4 CVE-2023-35157 >= 3.2-milestone-3, < 14.10.6, >= 15.0-rc-0, < 15.1-rc-1 14.10.6, 15.1-rc-1
  20. XWiki Platform's async and display macro allow displaying and interacting with any document in restricted mode
    Crítica · 9.9 CVE-2023-29526 >= 10.11.1, < 13.10.11, >= 14.0-rc-1, < 14.4.8, >= 14.5, < 14.10.3 13.10.11, 14.4.8, 14.10.3
  21. XWiki Platform vulnerable to code injection in display method used in user profiles
    Crítica · 9.9 CVE-2023-29523 >= 3.3-milestone-1, < 13.10.11, >= 14.0-rc-1, < 14.4.8, >= 14.5, < 14.10.2 13.10.11, 14.4.8, 14.10.2
Mostrar más (8) Mostrando 21 de 29

Identifica las vulnerabilidades de tu aplicación

Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.

Conectar tu aplicación
Newsletter DockRay

La seguridad de tus aplicaciones en tu correo

Vulnerabilidades importantes, recomendaciones concretas y consejos prácticos para tus aplicaciones. Elige tus tecnologías y sigue lo que importa para tu proyecto.

  • Un resumen diario de nuevas vulnerabilidades, también las críticas.
  • Avisos sobre actualizaciones importantes.
  • Consejos prácticos sobre seguridad y monitorización de aplicaciones.

Déjalo vacío para recibir avisos de todas las tecnologías.

Política de privacidad

Suscripción gratuita. Date de baja con un clic en cualquier correo.