CVE-2022-24898: falha de média gravidade em xwiki-commons
Arbitrary file access through XML parsing in org.xwiki.commons:xwiki-commons-xml
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 4.9epss 1.5%
org.xwiki.commons:xwiki-commons-xml is a common module used by other XWiki top level projects. Starting in version 2.7 and prior to versions 12.10.10, 13.4.4, and 13.8-rc-1, it is possible for a script to access any file accessing to the user running XWiki application server with XML External Entity Injection through the XML script service. The problem has been patched in versions 12.10.10, 13.4.4, and 13.8-rc-1. There is no easy workaround for fixing this vulnerability other than upgrading and being careful when giving Script rights.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
xwiki · xwiki-commonsCVEs relacionadas — xwiki-commons
No mesmo produto, das mais perigosas para as menos.
CVE-2026-23734CRITICALXWiki Platform: Path traversal via resources parameter in ssx and jsx endpoints when using leading slashEPSS 18.5%CVE-2024-31996CRITICALXWiki Commons missing escaping of `{` in Velocity escapetool allows remote code executionEPSS 2.1%CVE-2022-24897HIGHArbitrary filesystem write access from VelocityEPSS 1.8%CVE-2023-29528CRITICALCross-site Scripting in org.xwiki.commons:xwiki-commons-xmlEPSS 1.3%CVE-2023-26055CRITICALXWiki Commons may allow privilege escalation to programming rights via user's first nameEPSS 1.2%CVE-2023-29201CRITICALorg.xwiki.commons:xwiki-commons-xml Cross-site Scripting vulnerabilityEPSS 1.2%