Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2022-23654— Improper write access check in Requarks/wiki

Quick assessment

Affected
Requarks wiki
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Wiki.js是Requarks.io团队的一套基于Node.js并使用JavaScript语言编写的开源Wiki软件。 Wiki.js存在安全漏洞，该漏洞源于应用缺少对于权限的控制与管理，在受影响的版本中，对受限制的一组路径具有写访问权限的经过身份验证的用户可以通过指定不同的目标页面ID来更新允许路径之外的页面，同时保持路径不变。访问控制错误地根据用户提供的值而不是与页面ID相关联的实际路径来检查路径访问。

CVSS 8.1 · High EPSS 0.72% · P51

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2022-23654

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Improper write access check in Requarks/wiki
Source: CVE Program / CVE List V5
Vulnerability Description
Wiki.js is a wiki app built on Node.js. In affected versions an authenticated user with write access on a restricted set of paths can update a page outside the allowed paths by specifying a different target page ID while keeping the path intact. The access control incorrectly check the path access against the user-provided values instead of the actual path associated to the page ID. Commit https://github.com/Requarks/wiki/commit/411802ec2f654bb5ed1126c307575b81e2361c6b fixes this vulnerability by checking access control on the path associated with the page ID instead of the user-provided value. When the path is different than the current value, a second access control check is then performed on the user-provided path before the move operation.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
认证机制不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
Wiki.js 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Wiki.js是Requarks.io团队的一套基于Node.js并使用JavaScript语言编写的开源Wiki软件。 Wiki.js存在安全漏洞，该漏洞源于应用缺少对于权限的控制与管理，在受影响的版本中，对受限制的一组路径具有写访问权限的经过身份验证的用户可以通过指定不同的目标页面ID来更新允许路径之外的页面，同时保持路径不变。访问控制错误地根据用户提供的值而不是与页面ID相关联的实际路径来检查路径访问。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Requarks wiki < 2.5.276 -

II. Public POCs for CVE-2022-23654

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2022-23654

请登录查看更多情报信息。

Patches & Fixes for CVE-2022-23654 (1)

Vendor Advisories for CVE-2022-23654 (1)

IV. Related Vulnerabilities

Same product: wiki
Same vendor: Requarks
Same weakness: CWE-287

V. Comments for CVE-2022-23654

No comments yet

Leave a comment