What is GHSA-ghcq-472w-vf4h?

GHSA-ghcq-472w-vf4h is a security advisory published by GitHub Security Advisories with Medium severity. Incorrect Use of Privileged APIs in org.xwiki.platform.skin.skinx

Which CVE IDs does GHSA-ghcq-472w-vf4h cover?

GHSA-ghcq-472w-vf4h covers the following CVE IDs: CVE-2022-24821. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-ghcq-472w-vf4h?

GHSA-ghcq-472w-vf4h has a CVSS v3 base score of 6.8, published by GitHub Security Advisories.

Which products are affected by GHSA-ghcq-472w-vf4h?

GHSA-ghcq-472w-vf4h affects 3 products, including: maven/org.xwiki.platform:xwiki-platform-skin-skinx:\u003e= 13.5.0, \u003c 13.10; maven/org.xwiki.platform:xwiki-platform-skin-skinx:\u003c 12.10.11; maven/org.xwiki.platform:xwiki-platform-skin-skinx:\u003e= 13.0.0, \u003c 13.4.6.

GHSA-ghcq-472w-vf4hMediumCVSS 6.8

Incorrect Use of Privileged APIs in org.xwiki.platform.skin.skinx

Vendor

GitHub Security Advisories

Published

April 8, 2022

Last Modified

January 27, 2023

🔗 CVE IDs covered (1)

CVE-2022-24821 →

📋 Description

Impact

Simple users can create global SSX/JSX without specific rights: in theory only users with Programming Rights should be allowed to create SSX or JSX that are executed everywhere on a wiki. But a bug allow anyone with edit rights to actually create those.

Patches

This issue has been patched in XWiki 13.10-rc-1, 12.10.11 and 13.4.6.

Workarounds

There's no easy workaround for this issue, administrators should upgrade their wiki.

References

https://jira.xwiki.org/browse/XWIKI-19155

For more information

If you have any questions or comments about this advisory:

Open an issue in JIRA
Email us at XWiki Security ML

🎯 Affected products3

maven/org.xwiki.platform:xwiki-platform-skin-skinx:>= 13.5.0, < 13.10
maven/org.xwiki.platform:xwiki-platform-skin-skinx:< 12.10.11
maven/org.xwiki.platform:xwiki-platform-skin-skinx:>= 13.0.0, < 13.4.6