We found results for “”
CVE-2022-41929
Good to know:
Date: November 23, 2022
org.xwiki.platform:xwiki-platform-oldcore is missing authorization in User#setDisabledStatus, which may allow an incorrectly authorized user with only Script rights to enable or disable a user. This operation is meant to only be available for users with admin rights. This problem has been patched in XWiki 13.10.7, 14.4.2 and 14.5RC1.
Language: Java
Severity Score
Related Resources (5)
Severity Score
Weakness Type (CWE)
Missing Authorization
CWE-862Top Fix
Upgrade Version
Upgrade to version org.xwiki.platform:xwiki-platform-oldcore:13.10.7,14.4.2,14.5
CVSS v3.1
Base Score: |
|
---|---|
Attack Vector (AV): | NETWORK |
Attack Complexity (AC): | LOW |
Privileges Required (PR): | HIGH |
User Interaction (UI): | NONE |
Scope (S): | UNCHANGED |
Confidentiality (C): | NONE |
Integrity (I): | HIGH |
Availability (A): | NONE |