Miggo Logo
Miggo Vulnerability Database
→
CVE-2022-23616

CVE-2022-23616: Remote code execution in xwiki-platform

8.8

CVSS Score
3.1

Basic Information

CVE ID
CVE-2022-23616
GHSA ID
GHSA-mgjw-2wrp-r535
EPSS Score
0.84712%
CWE
CWE-74
Published
2/9/2022
Updated
1/27/2023
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
org.xwiki.platform:xwiki-platform-administration-uimaven>= 3.1-milestone-1, <= 13.013.1RC1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from the ResetPassword feature's use of programming rights during user profile saves. The commit diff shows the patched version replaced 'saveWithProgrammingRights()' with 'saveAsAuthor()', indicating this was the vulnerable method. When combined with user-controlled Groovy scripts in profiles, this function enabled privilege escalation by executing untrusted code with system-level permissions during the password reset operation.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t It's possi*l* *or *n unprivil**** us*r to p*r*orm * r*mot* *o** *x**ution *y inj**tin* * *roovy s*ript in **r own pro*il* *n* *y **llin* t** R*s*t p*sswor* ***tur* sin** t** ***tur* is p*r*ormin* * s*v* o* t** us*r pro*il* wit* pro*r*mmin*

Reasoning

T** vuln*r**ility st*ms *rom t** R*s*tP*sswor* ***tur*'s us* o* pro*r*mmin* ri**ts *urin* us*r pro*il* s*v*s. T** *ommit *i** s*ows t** p*t**** v*rsion r*pl**** 's*v*Wit*Pro*r*mmin*Ri**ts()' wit* 's*v**s*ut*or()', in*i**tin* t*is w*s t** vuln*r**l* m