Miggo Logo
Miggo Vulnerability Database
→
CVE-2022-41930

CVE-2022-41930:
Missing Authorization to enable or disable users in org.xwiki.platform:xwiki-platform-user-profile-ui

9.1

CVSS Score
3.1

Basic Information

CVE ID
CVE-2022-41930
GHSA ID
GHSA-p5v9-g8w8-5q4v
EPSS Score
0.58962%
CWE
CWE-862
Published
11/21/2022
Updated
1/22/2025
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
org.xwiki.platform:xwiki-platform-user-profile-uimaven>= 12.4, < 13.10.713.10.7
org.xwiki.platform:xwiki-platform-user-profile-uimaven>= 14.0.0, < 14.4.214.4.2

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from missing authorization checks in the Velocity template code that processes enable/disable actions. The original code (before patch) only validated CSRF token and user existence, but didn't check: 1) If the requester has admin privileges ($hasAdmin), and 2) If the target user is the current user ($isCurrentUser). The commit diff shows these checks were added in the conditional statement that gates the enable/disable functionality. The file path is explicitly shown in the commit diff, and the CWE-862 (Missing Authorization) classification directly maps to these missing security checks in the template's control flow.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t *ny us*r (lo**** in or not) wit* ****ss to t** p*** XWiki.XWikiUs*rPro*il*S***t **n *n**l* or *is**l* *ny us*r pro*il*. T*is mi**t *llow to * *is**l** us*r to r*-*n**l* t**ms*lv*s, or to *n *tt**k*r to *is**l* *ny us*r o* t** wiki. ###

Reasoning

T** vuln*r**ility st*ms *rom missin* *ut*oriz*tion ****ks in t** V*lo*ity t*mpl*t* *o** t**t pro**ss*s *n**l*/*is**l* **tions. T** ori*in*l *o** (***or* p*t**) only v*li**t** *SR* tok*n *n* us*r *xist*n**, *ut *i*n't ****k: *) I* t** r*qu*st*r **s **