{"id":"CVE-2022-23621","summary":"Missing authorization in xwiki-platform","details":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with SCRIPT right can read any file located in the XWiki WAR (for example xwiki.cfg and xwiki.properties) through XWiki#invokeServletAndReturnAsString as `$xwiki.invokeServletAndReturnAsString(\"/WEB-INF/xwiki.cfg\")`. This issue has been patched in XWiki versions 12.10.9, 13.4.3 and 13.7-rc-1. Users are advised to update. The only workaround is to limit SCRIPT right.","aliases":["GHSA-2jhm-qp48-hv5j"],"modified":"2026-08-12T13:00:02.054893Z","published":"2022-02-09T21:25:11Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-862"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23621.json"},"references":[{"type":"WEB","url":"https://jira.xwiki.org/browse/XWIKI-18870"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23621.json"},{"type":"ADVISORY","url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-2jhm-qp48-hv5j"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23621"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/df8bd49b5a4d87a427002c6535fb5b1746ff117a"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/xwiki/xwiki-commons","events":[{"introduced":"0"},{"fixed":"498d9c5b0098754a675e402e51361367db4c7c9c"},{"introduced":"427c24372a3f8de165dedf1c257e8e3829e080c7"},{"fixed":"2af5ac4cf9cebfc79788ba984e10dc1d06470556"},{"introduced":"48e84afcd78dddb228a53067132edcaace7c65d2"},{"last_affected":"2636e39e722f1457e81a316a00526abffcc98d45"}],"database_specific":{"cpe":"cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"12.10.9"},{"introduced":"13.4"},{"fixed":"13.4.3"},{"introduced":"13.4.4"},{"last_affected":"13.7"}],"source":"CPE_RANGE"}},{"type":"GIT","repo":"https://github.com/xwiki/xwiki-platform","events":[{"introduced":"0"},{"fixed":"212f09c83623bb170b0ab897c976d39f8abb0e31"},{"introduced":"e96ff4c0aa5072590b0a876a7de5003e6a891e47"},{"fixed":"f9533eeb3ac5b9cc18e37e25c3bb289bc7bc6193"},{"introduced":"ac12f8e2f29d301d4dcd677381c24b864fa1544b"},{"fixed":"df8bd49b5a4d87a427002c6535fb5b1746ff117a"}],"database_specific":{"cpe":"cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"12.10.9"},{"introduced":"13.4"},{"fixed":"13.4.3"},{"introduced":"13.4.4"},{"last_affected":"13.7"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["xwiki-commons-13.7","xwiki-commons-13.7-rc-1","xwiki-commons-13.4.2","xwiki-commons-13.4.1","xwiki-commons-12.10.8","xwiki-commons-13.4","xwiki-commons-12.10.7","xwiki-commons-12.10.6","xwiki-commons-12.10.5","xwiki-commons-12.10.4","xwiki-commons-12.10.3","xwiki-commons-12.10.2","xwiki-commons-12.10.1","xwiki-commons-12.10","xwiki-commons-8.3-milestone-2","xwiki-commons-8.3-milestone-1","xwiki-commons-8.2-milestone-2","xwiki-commons-8.2-milestone-1","xwiki-commons-8.1-milestone-2","xwiki-commons-8.1-milestone-1","xwiki-commons-8.0-milestone-2","xwiki-commons-8.0-milestone-1","xwiki-platform-13.4.2","xwiki-platform-13.4.1","xwiki-platform-12.10.8","xwiki-platform-13.4","xwiki-platform-12.10.7","xwiki-platform-12.10.6","xwiki-platform-12.10.5","xwiki-platform-12.10.4","xwiki-platform-12.10.3","xwiki-platform-12.10.2","xwiki-platform-12.10.1","xwiki-platform-12.10","xwiki-platform-9.9-rc-2","xwiki-platform-8.3-milestone-1","xwiki-platform-8.2-milestone-2","xwiki-platform-8.2-milestone-1","xwiki-platform-8.1-milestone-2","xwiki-platform-8.1-milestone-1","xwiki-platform-8.0-milestone-2","xwiki-platform-8.0-milestone-1","xwiki-platform-7.4-milestone-2","xwiki-platform-7.4-milestone-1","xwiki-platform-7.3-milestone-2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-23621.json","vanir_signatures_modified":"2026-08-12T13:00:02Z","vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["312735897479458807391540801967798482192","288540640851196478397814797030605779298","207615600172929574598666783583097132668","189548784275655133077180018242399575151","44909460929864241674364482150015235638","3290161762828059693328281462853358647","310184185500440019218780499755935875925","213734655900568494201808825804160032542","264334325072214292464630722879088169038","41202067934689620456874653839621186544","316858996173030048806321253285824776340","78203600794019819186239343392405163690","62142681166650348837374197389525470250","143417270559226954621299233449701361133","62465368041667356164272499767703606676","327616427435342513849366077418468608780","129387923336302803555474060756569645849","56606373469797819418082253693990875100","54134763038435541220464723341844105130","96854081116692822803023502766826007750","228095990763410698448970426733766551370","139332060865633223781969421220660697005","323381034331915400045266056863617085858"],"threshold":0.9},"id":"CVE-2022-23621-7f8c2c98","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/df8bd49b5a4d87a427002c6535fb5b1746ff117a","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/XWiki.java"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/df8bd49b5a4d87a427002c6535fb5b1746ff117a","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/api/XWiki.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["234276073509469624203755440520741318351","44584423755903519574830026123585854072","102657509338869881264397836905993677036","241973162086491505416357681560334156310","52133322952623813513076419376037087579","123203578948503229588971717640322396768","39827609826680343926315031712147164516"]},"id":"CVE-2022-23621-c0d69169"},{"target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/XWiki.java","function":"invokeServletAndReturnAsString"},"deprecated":false,"digest":{"function_hash":"44377995968361951554719057961784599202","length":353},"id":"CVE-2022-23621-f942922c","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/df8bd49b5a4d87a427002c6535fb5b1746ff117a"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H"}]}