CVE-2022-36092 XWiki Platform Old Core vulnerable to Authentication Bypass Using the Login Action

What is CVE-2022-36092?

CVE-2022-36092 is a high-severity authentication bypass vulnerability in Xwiki Xwiki, published on 8 Sep 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

XWiki Platform Old Core is a core package for XWiki Platform, a generic wiki platform. Prior to versions 14.2 and 13.10.4, all rights checks that would normally prevent a user from viewing a document on a wiki can be bypassed using the login action and directly specified templates. This exposes title, content and comments of any document and properties of objects, though class and property name must be known. This is also exploitable on private wikis. This has been patched in versions 14.2 and 13.10.4 by properly checking view rights before loading documents and disallowing non-default templates in the login, registration and skin action. As a workaround, it would be possible to protect all templates individually by adding code to check access rights first.

Weakness: CWE-287

Which versions are affected by CVE-2022-36092?

4 open source packages ship an affected version, including org.xwiki.platform:xwiki-platform-oldcore. It affects 1 product.

Products include Xwiki Xwiki.

How do I fix CVE-2022-36092?

Upgrade org.xwiki.platform:xwiki-platform-oldcore to a fixed version for your release line: 13.10.4 or 14.2.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2022-36092 being exploited?

There is no known exploitation of CVE-2022-36092 in the wild and no public exploit code.

Other vulnerabilities in Xwiki Xwiki

• CVE-2025-24893 XWiki Platform Eval Injection Exploited Critical 9.8
• CVE-2025-53836 XWiki Rendering is vulnerable to RCE attacks when processing nested macros Critical 10.0
• CVE-2024-55662 XWiki allows remote code execution through the extension sheet Critical 10.0
• CVE-2024-55877 XWiki allows remote code execution from account through macro descriptions and XWiki.XWikiSyntaxMacrosList Critical 10.0
• CVE-2024-37901 XWiki Platform vulnerable to remote code execution from account via SearchSuggestConfigSheet Critical 10.0

All Xwiki Xwiki vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-8h89-34w2-jpfm.