CVE-2022-24898

Description

org.xwiki.commons:xwiki-commons-xml is a common module used by other XWiki top level projects. Starting in version 2.7 and prior to versions 12.10.10, 13.4.4, and 13.8-rc-1, it is possible for a script to access any file accessing to the user running XWiki application server with XML External Entity Injection through the XML script service. The problem has been patched in versions 12.10.10, 13.4.4, and 13.8-rc-1. There is no easy workaround for fixing this vulnerability other than upgrading and being careful when giving Script rights.

Risk Information

Base Score

4.9

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

EPSS Score

Exploitation Probability

0.127

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2022-24898 are fixed in XWiki - commons-xml 13.8	Windows
Vulnerabilities CVE-2022-24898 are fixed in XWiki - commons-xml 12.10.10	Windows
Vulnerabilities CVE-2022-24898 are fixed in XWiki - commons-xml 13.4.4	Windows
Vulnerabilities CVE-2022-24898 are fixed in XWiki - commons-xml for Linux 13.8	Linux
Vulnerabilities CVE-2022-24898 are fixed in XWiki - commons-xml for Linux 12.10.10	Linux
Vulnerabilities CVE-2022-24898 are fixed in XWiki - commons-xml for Linux 13.4.4	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234