CVE-2022-24819
published 2022-04-08CVE-2022-24819: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A guest user without the right to view pages of the…
PriorityP340medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EXPLOIT
EPSS
3.28%
86.9th percentile
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A guest user without the right to view pages of the wiki can still list documents related to users of the wiki. The problem has been patched in XWiki versions 12.10.11, 13.4.4, and 13.9-rc-1. There is no known workaround for this problem.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| xwiki | xwiki | < 12.10.11 | 12.10.11 |
| xwiki | xwiki | — | — |
| xwiki | xwiki | >= 13.0.0 < 13.4.4 | 13.4.4 |
| xwiki | xwiki-platform | < 4.3 | 4.3 |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Unauthenticated user can retrieve the list of users through uorgsuggest.vm
osv·2022-04-08
CVE-2022-24819 [MEDIUM] Unauthenticated user can retrieve the list of users through uorgsuggest.vm
Unauthenticated user can retrieve the list of users through uorgsuggest.vm
A guest user without the right to view pages of the wiki can still list documents related to users of the wiki. The problem has been patched in XWiki versions 12.10.11, 13.4.4, and 13.9-rc-1. There is no known workaround for this problem.
GHSA
Unauthenticated user can retrieve the list of users through uorgsuggest.vm
ghsa·2022-04-08
CVE-2022-24819 [MEDIUM] CWE-359 Unauthenticated user can retrieve the list of users through uorgsuggest.vm
Unauthenticated user can retrieve the list of users through uorgsuggest.vm
A guest user without the right to view pages of the wiki can still list documents related to users of the wiki. The problem has been patched in XWiki versions 12.10.11, 13.4.4, and 13.9-rc-1. There is no known workaround for this problem.
No detection rules found.
Nuclei
XWiki < 12.10.11, 13.4.4 & 13.9-rc-1 - Information Disclosure
nuclei·CVSS 5.3
CVE-2022-24819 [MEDIUM] XWiki < 12.10.11, 13.4.4 & 13.9-rc-1 - Information Disclosure
XWiki ", "<rs id=", "icon=\"")'
condition: or
- type: dsl
dsl:
- 'contains_any(content_type, "application/json", "text/xml")'
- "status_code == 401 || status_code_2 == 200"
condition: and
# digest: 4a0a00473045022055f0c38f2986bfc4726f3bf0e9d10cad67b77a7742236f41eae25737ec8a28aa022100f9134788c361724d25f62838c0962ff108a7641282b10e2cd678477d63161220:922c64590222798bb761d5b6d8e72950
No writeups or analysis indexed.
2022-04-08
Published