CVE-2022-24898 Arbitrary file access through XML parsing in org.xwiki.commons:xwiki-commons-xml

What is CVE-2022-24898?

CVE-2022-24898 is a medium-severity vulnerability in xwiki-commons, published on 28 Apr 2022. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

org.xwiki.commons:xwiki-commons-xml is a common module used by other XWiki top level projects. Starting in version 2.7 and prior to versions 12.10.10, 13.4.4, and 13.8-rc-1, it is possible for a script to access any file accessing to the user running XWiki application server with XML External Entity Injection through the XML script service. The problem has been patched in versions 12.10.10, 13.4.4, and 13.8-rc-1. There is no easy workaround for fixing this vulnerability other than upgrading and being careful when giving Script rights.

Weakness: CWE-611

Which versions are affected by CVE-2022-24898?

6 open source packages ship an affected version, including org.xwiki.commons:xwiki-commons-xml. It affects 1 product.

Products include Xwiki Commons.

How do I fix CVE-2022-24898?

Upgrade org.xwiki.commons:xwiki-commons-xml to a fixed version for your release line: 13.4.4, 13.8-rc-1 or 12.10.10.

Is CVE-2022-24898 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-24898 exists.

Other vulnerabilities in xwiki-commons

• CVE-2023-26055 XWiki Commons may allow privilege escalation to programming rights via user's first name Critical 10.0
• CVE-2023-36471 HTML sanitizer allows form elements in restricted in org.xwiki.commons:xwiki-commons-xml Critical 9.1
• CVE-2023-29528 Cross-site Scripting in org.xwiki.commons:xwiki-commons-xml Critical 9.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-m2r5-4w96-qxg5.