CVE-2022-41927

Severity CVSS v4.0:

Pending analysis

Type:

CWE-352 Cross-Site Request Forgery (CSRF)

Publication date:

23/11/2022

Last modified:

30/11/2022

Description

XWiki Platform is vulnerable to Cross-Site Request Forgery (CSRF) that may allow attackers to delete or rename tags without needing any confirmation. The problem has been patched in XWiki 13.10.7, 14.4.1 and 14.5RC1. Workarounds: It&#39;s possible to patch existing instances directly by editing the page Main.Tags and add this kind of check, in the code for renaming and for deleting: ``` #if (!$services.csrf.isTokenValid($request.get(&#39;form_token&#39;))) #set ($discard = $response.sendError(401, "Wrong CSRF token")) #end ```

Impact

Vector 3.x

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N CVSS v3.1 Severity and Metrics:

Base Score: 7.40 HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N

Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope (S): Changed
Confidentiality (C): None
Integrity (I): High
Availability (A): None

Base Score 3.x

7.40

Severity 3.x

HIGH

Vulnerable products and versions

CPE	From	Up to
cpe:2.3:a:xwiki:xwiki::::::::	3.2 (excluding)	13.10.7 (excluding)
cpe:2.3:a:xwiki:xwiki:3.2:milestone2::::::
cpe:2.3:a:xwiki:xwiki:3.2:milestone3::::::
cpe:2.3:a:xwiki:xwiki:14.4:::::::*

To consult the complete list of CPE names with products and versions, see this page

CVE-2022-41927

Description

Impact

Vulnerable products and versions

References to Advisories, Solutions, and Tools