{"id":"GHSA-p5v9-g8w8-5q4v","summary":"Missing Authorization to enable or disable users in org.xwiki.platform:xwiki-platform-user-profile-ui","details":"### Impact\n\nAny user (logged in or not) with access to the page XWiki.XWikiUserProfileSheet can enable or disable any user profile. This might allow to a disabled user to re-enable themselves, or to an attacker to disable any user of the wiki. \n\n### Patches\n\nThe problem has been patched in XWiki 13.10.7, 14.5RC1 and 14.4.2. \n\n### Workarounds\n\nThe problem can be patched immediately by editing the page `XWiki.XWikiUserProfileSheet` in the wiki and by performing the changes contained in https://github.com/xwiki/xwiki-platform/commit/5be1cc0adf917bf10899c47723fa451e950271fa.\n\n### References\n\n  * https://github.com/xwiki/xwiki-platform/commit/5be1cc0adf917bf10899c47723fa451e950271fa\n  * https://jira.xwiki.org/browse/XWIKI-19792\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [JIRA](https://jira.xwiki.org)\n* Email us at [security ML](mailto:security@xwiki.org)\n","aliases":["CVE-2022-41930"],"modified":"2025-01-22T17:43:50Z","published":"2022-11-21T22:35:39Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2022-11-21T22:35:39Z","nvd_published_at":"2022-11-23T19:15:00Z","cwe_ids":["CWE-862"],"severity":"CRITICAL"},"references":[{"type":"WEB","url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-p5v9-g8w8-5q4v"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-41930"},{"type":"WEB","url":"https://github.com/xwiki/xwiki-platform/commit/5be1cc0adf917bf10899c47723fa451e950271fa"},{"type":"PACKAGE","url":"https://github.com/xwiki/xwiki-platform"},{"type":"WEB","url":"https://jira.xwiki.org/browse/XWIKI-19792"}],"affected":[{"package":{"name":"org.xwiki.platform:xwiki-platform-user-profile-ui","ecosystem":"Maven","purl":"pkg:maven/org.xwiki.platform/xwiki-platform-user-profile-ui"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.4"},{"fixed":"13.10.7"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/11/GHSA-p5v9-g8w8-5q4v/GHSA-p5v9-g8w8-5q4v.json"}},{"package":{"name":"org.xwiki.platform:xwiki-platform-user-profile-ui","ecosystem":"Maven","purl":"pkg:maven/org.xwiki.platform/xwiki-platform-user-profile-ui"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14.0.0"},{"fixed":"14.4.2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/11/GHSA-p5v9-g8w8-5q4v/GHSA-p5v9-g8w8-5q4v.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"}]}