CVE-2022-41930: org.xwiki.platform:xwiki-platform-user-profile-ui is missing authorization to enable or disable users. Any user (logged in or not) with access to the page…

PriorityP345high8.2CVSS 3.1

AVNACLPRNUINSUCNIHAL

EPSS

0.82%

52.5th percentile

org.xwiki.platform:xwiki-platform-user-profile-ui is missing authorization to enable or disable users. Any user (logged in or not) with access to the page XWiki.XWikiUserProfileSheet can enable or disable any user profile. This might allow to a disabled user to re-enable themselves, or to an attacker to disable any user of the wiki. The problem has been patched in XWiki 13.10.7, 14.5RC1 and 14.4.2. Workarounds: The problem can be patched immediately by editing the page `XWiki.XWikiUserProfileSheet` in the wiki and by performing the changes contained in https://github.com/xwiki/xwiki-platform/commit/5be1cc0adf917bf10899c47723fa451e950271fa.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
xwiki	xwiki	—	—
xwiki	xwiki	—	—
xwiki	xwiki	>= 12.4 < 13.10.7	13.10.7
xwiki	xwiki	>= 14.0.0 < 14.4.2	14.4.2
xwiki	xwiki-platform	—	—
xwiki	xwiki-platform	—	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.