Missing Authorization in XWiki platform - CVE-2022-23621
Published: February 9, 2022 / Updated: May 5, 2026
Vulnerability identifier: #VU130029
CSH Severity: Low
CVSS v4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-23621
CWE-ID: CWE-862
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to missing authorization in XWiki#invokeServletAndReturnAsString when handling servlet path input. A remote privileged user can request a file path within the WAR to disclose sensitive information.
Before XWiki 7.4, the same access was possible with EDIT right instead of SCRIPT right.
Affected software
XWiki platform
How to mitigate CVE-2022-23621
Install security update from vendor's website.
XWiki platform - addressed in versions 12.10.9, 13.4.3, 13.7