CVE-2022-31167

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

XWiki Platform Security Parent POM contains the security APIs for XWiki Platform, a generic wiki platform. Starting with version 5.0 and prior to 12.10.11, 13.10.1, and 13.4.6, a bug in the security cache stores rules associated to document Page1.Page2 and space Page1.Page2 in the same cache entry. That means that it's possible to overwrite the rights of a space or a document by creating the page of the space with the same name and checking the right of the new one first so that they end up in the security cache and are used for the other too. The problem has been patched in XWiki 12.10.11, 13.10.1, and 13.4.6. There are no known workarounds.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-285CWE-862

Affected software

No affected versions have been published.

Timeline

Published
Sep 7, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-311688.8Zulip is an open source team chat tool. Due to an incorrect authorization check in Zulip Server 5.4 and earlier, a member of an organizationCVE-2022-311697.5Wasmtime is a standalone runtime for WebAssembly. There is a bug in Wasmtime's code generator, Cranelift, for AArch64 targets where constantCVE-2022-311707.5OpenZeppelin Contracts is a library for smart contract development. Versions 4.0.0 until 4.7.1 are vulnerable to ERC165Checker reverting insCVE-2022-311727.5OpenZeppelin Contracts is a library for smart contract development. Versions 4.1.0 until 4.7.1 are vulnerable to the SignatureChecker revertCVE-2022-311737.5Juniper is a GraphQL server library for Rust. Affected versions of Juniper are vulnerable to uncontrolled recursion resulting in a program cCVE-2022-311754.7CKEditor 5 is a JavaScript rich text editor. A cross-site scripting vulnerability has been discovered affecting three optional CKEditor 5's CVE-2022-311768.1Grafana Image Renderer is a Grafana backend plugin that handles rendering of panels & dashboards to PNGs using a headless browser (Chromium/CVE-2022-311772.7Flask-AppBuilder is an application development framework built on top of Flask python framework. In versions prior to 4.1.3 an authenticatedCVE-2022-311784.3eLabFTW is an electronic lab notebook manager for research teams. A vulnerability was discovered which allows a logged in user to read a temCVE-2022-311799.8Shescape is a simple shell escape package for JavaScript. Versions prior to 1.5.8 were found to be subject to code injection on windows. ThiCVE-2022-31189.8A vulnerability was found in Sourcecodehero ERP System Project. It has been rated as critical. This issue affects some unknown processing ofCVE-2022-311809.8Shescape is a simple shell escape package for JavaScript. Affected versions were found to have insufficient escaping of white space when int