CVE-2022-41929

MediumCVSS 4.9/10Last modified Jun 17, 2026

Description

org.xwiki.platform:xwiki-platform-oldcore is missing authorization in User#setDisabledStatus, which may allow an incorrectly authorized user with only Script rights to enable or disable a user. This operation is meant to only be available for users with admin rights. This problem has been patched in XWiki 13.10.7, 14.4.2 and 14.5RC1.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Nov 23, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-41938.8Insufficient policy enforcement in File System API in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to bypass file system r CVE-2022-419308.2org.xwiki.platform:xwiki-platform-user-profile-ui is missing authorization to enable or disable users. Any user (logged in or not) with acce CVE-2022-419318.8xwiki-platform-icon-ui is vulnerable to Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection'). Any user wit CVE-2022-419325.3XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to make XWiki create CVE-2022-419336.5XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When the `reset a forgotten passwor CVE-2022-419348.8XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with view rights on common CVE-2022-419354.3XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users without the right to view doc CVE-2022-419367.5XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The `modifications` rest endpoint d CVE-2022-419378.1XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The application allows anyone with CVE-2022-419385.4Flarum is an open source discussion platform. Flarum's page title system allowed for page titles to be converted into HTML DOM nodes when pa CVE-2022-419397.4knative.dev/func is is a client library and CLI enabling the development and deployment of Kubernetes functions. Developers using a maliciou CVE-2022-41948.8Use after free in Accessibility in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to potentially exploit heap corruption via