CVE-2022-24820

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A guest user without the right to view pages of the wiki can still list documents by rendering some velocity documents. The problem has been patched in XWiki versions 12.10.11, 13.4.4, and 13.9-rc-1. There is no known workaround for this problem.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-359CWE-306

Affected software

No affected versions have been published.

Timeline

Published
Apr 8, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-248218.1XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Simple users can create global SSX/CVE-2022-248227.5Podium is a library for building micro frontends. @podium/layout is a module for building a Podium layout server, and @podium/proxy is a modCVE-2022-248235.5Netty is an open-source, asynchronous event-driven network application framework. The package `io.netty:netty-codec-http` prior to version 4CVE-2022-248245.3Discourse is an open source platform for community discussion. In affected versions an attacker can poison the cache for anonymous (i.e. notCVE-2022-248255.3Smokescreen is a simple HTTP proxy that fogs over naughty URLs. The primary use case for Smokescreen is to prevent server-side request forgeCVE-2022-248267.8On Windows, if Git LFS operates on a malicious repository with a `..exe` file as well as a file named `git.exe`, and `git.exe` is not found CVE-2022-248278.1Elide is a Java library that lets you stand up a GraphQL/JSON-API web service with minimal effort. When leveraging the following together: ECVE-2022-248288.8Composer is a dependency manager for the PHP programming language. Integrators using Composer code to call `VcsDriver::getFileContent` can hCVE-2022-248299.8Garden is an automation platform for Kubernetes development and testing. In versions prior to 0.12.39 multiple endpoints did not require autCVE-2022-24837.1The bootloader in the Nokia ASIK AirScale system module (versions 474021A.101 and 474021A.102) loads public keys for firmware verification sCVE-2022-248309.8OpenClinica is an open source software for Electronic Data Capture (EDC) and Clinical Data Management (CDM). OpenClinica prior to version 3.CVE-2022-248319.8OpenClinica is an open source software for Electronic Data Capture (EDC) and Clinical Data Management (CDM). Versions prior to 3.16.1 are vu
CVE-2022-24820: Medium severity, CVSS 5.3 | Vulnix