CVE-2022-24821

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Simple users can create global SSX/JSX without specific rights: in theory only users with Programming Rights should be allowed to create SSX or JSX that are executed everywhere on a wiki. But a bug allow anyone with edit rights to actually create those. This issue has been patched in XWiki 13.10-rc-1, 12.10.11 and 13.4.6. There's no easy workaround for this issue, administrators should upgrade their wiki.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-648

Affected software

No affected versions have been published.

Timeline

Published
Apr 8, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-248227.5Podium is a library for building micro frontends. @podium/layout is a module for building a Podium layout server, and @podium/proxy is a modCVE-2022-248235.5Netty is an open-source, asynchronous event-driven network application framework. The package `io.netty:netty-codec-http` prior to version 4CVE-2022-248245.3Discourse is an open source platform for community discussion. In affected versions an attacker can poison the cache for anonymous (i.e. notCVE-2022-248255.3Smokescreen is a simple HTTP proxy that fogs over naughty URLs. The primary use case for Smokescreen is to prevent server-side request forgeCVE-2022-248267.8On Windows, if Git LFS operates on a malicious repository with a `..exe` file as well as a file named `git.exe`, and `git.exe` is not found CVE-2022-248278.1Elide is a Java library that lets you stand up a GraphQL/JSON-API web service with minimal effort. When leveraging the following together: ECVE-2022-248288.8Composer is a dependency manager for the PHP programming language. Integrators using Composer code to call `VcsDriver::getFileContent` can hCVE-2022-248299.8Garden is an automation platform for Kubernetes development and testing. In versions prior to 0.12.39 multiple endpoints did not require autCVE-2022-24837.1The bootloader in the Nokia ASIK AirScale system module (versions 474021A.101 and 474021A.102) loads public keys for firmware verification sCVE-2022-248309.8OpenClinica is an open source software for Electronic Data Capture (EDC) and Clinical Data Management (CDM). OpenClinica prior to version 3.CVE-2022-248319.8OpenClinica is an open source software for Electronic Data Capture (EDC) and Clinical Data Management (CDM). Versions prior to 3.16.1 are vuCVE-2022-248326.8GoCD is an open source a continuous delivery server. The bundled gocd-ldap-authentication-plugin included with the GoCD Server fails to corr