CVE-2022-41929CWE-862

Missing Authorization in User#setDisabledStatus in org.xwiki.platform:xwiki-platform-oldcore

Medium · published November 23, 2022

CVSS v3.1
4.9
EPSS
1%
Percentile
54.8
In the wild
Unconfirmed
What it is

org.xwiki.platform:xwiki-platform-oldcore is missing authorization in User#setDisabledStatus, which may allow an incorrectly authorized user with only Script rights to enable or disable a user. This operation is meant to only be available for users with admin rights. This problem has been patched in XWiki 13.10.7, 14.4.2 and 14.5RC1.

The record
Technical detail
CVSS v3.1
4.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00761 · 54.8th percentile
Weakness
CWE-862 · Missing Authorization
Published
2022-11-23T00:00Z
EPSS history
Timeline
  • 23 NOV 00:00Z
    Missing Authorization in User#setDisabledStatus in org.xwiki.platform:xwiki-platform-oldcore
    cvelistv5