CVE-2022-41937— Missing Authorization in XWiki Platform
Quick assessment
Affected
xwiki xwiki-platform
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
XWiki Platform是法国XWiki公司的一套用于创建Web协作应用程序的Wiki平台。 XWiki存在安全漏洞，该漏洞源于允许任何具有查看权限的人通过导入精心制作的XAR包来修改wiki的任何页面。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2022-41937
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Missing Authorization in XWiki Platform
Source: CVE Program / CVE List V5
Vulnerability Description
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The application allows anyone with view access to modify any page of the wiki by importing a crafted XAR package. The problem has been patched in XWiki 14.6RC1, 14.6 and 13.10.8. As a workaround, setting the right of the page Filter.WebHome and making sure only the main wiki administrators can view the application installed on main wiki or edit the page and apply the changed described in commit fb49b4f.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Vulnerability Title
XWiki Platform 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
XWiki Platform是法国XWiki公司的一套用于创建Web协作应用程序的Wiki平台。 XWiki存在安全漏洞，该漏洞源于允许任何具有查看权限的人通过导入精心制作的XAR包来修改wiki的任何页面。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| xwiki | xwiki-platform | < 13.10.8 | - |
|
II. Public POCs for CVE-2022-41937
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2022-41937
请登录查看更多情报信息。
Patches & Fixes for CVE-2022-41937 (1)
Vendor Advisories for CVE-2022-41937 (1)
Other References for CVE-2022-41937 (1)
IV. Related Vulnerabilities
Same product: xwiki-platform
-
CVE-2026-48048
XWiki Platform's Livetable results still allow reconstructin -
CVE-2026-48047
XWiki Platform vulnerable to potential arbitrary file writin -
CVE-2026-33137
XWiki Platform has an Unauthenticated XAR Import via REST /w -
CVE-2026-40105
XWiki has Reflected Cross-Site Scripting (XSS) in its page h -
CVE-2026-33229
XWiki Platform affected by remote code execution with script
Same vendor: xwiki
-
CVE-2026-48048
XWiki Platform's Livetable results still allow reconstructin -
CVE-2026-48047
XWiki Platform vulnerable to potential arbitrary file writin -
CVE-2026-33137
XWiki Platform has an Unauthenticated XAR Import via REST /w -
CVE-2026-23734
XWiki Platform: Path traversal via resources parameter in ss -
CVE-2026-40105
XWiki has Reflected Cross-Site Scripting (XSS) in its page h
Same weakness: CWE-862
-
CVE-2026-18431
Avada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated R -
CVE-2026-80193
Kimai before 2.62.0 Authorization Bypass via QuickEntry -
CVE-2026-80191
GROWI before 8.0.2 Missing Authorization on Attachment Retri -
CVE-2026-15916
Drupal core - Moderately critical - Information disclosure - -
CVE-2026-16645
PhotoSwipe - Responsive JavaScript Modal Image Gallery - Mod
V. Comments for CVE-2022-41937
No comments yet