Read the docs
TI-2022-13209 Aliases CVE-2022-31167GHSA-gg53-wf5x-r3r6

Improper authorization in xwiki-platform

Priority MEDIUM 64CWE-285Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-285.

Summary

XWiki Platform Security Parent POM contains the security APIs for XWiki Platform, a generic wiki platform. Starting with version 5.0 and prior to 12.10.11, 13.10.1, and 13.4.6, a bug in the security cache stores rules associated to document Page1.Page2 and space Page1.Page2 in the same cache entry. That means that it's possible to overwrite the rights of a space or a document by creating the page of the space with the same name and checking the right of the new one first so that they end up in the security cache and are used for the other too. The problem has been patched in XWiki 12.10.11, 13.10.1, and 13.4.6. There are no known workarounds.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0084 58th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed xwiki-platform (xwiki): 12.10.11, 13.4.6, 13.10.1org.xwiki.platform:xwiki-platform-security (Maven): 12.10.11, 13.4.6, 13.10.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
XWikixwiki-platform5.0 to before 12.10.11; 13.0 to before 13.4.6; 13.10 to before 13.10.112.10.11, 13.4.6, 13.10.1Patch availableCNA
—org.xwiki.platform:xwiki-platform-security (Maven)5.0 to before 12.10.1112.10.11Patch availableGHSA-gg53-wf5x-r3r6
—org.xwiki.platform:xwiki-platform-security (Maven)13.0 to before 13.4.613.4.6Patch availableGHSA-gg53-wf5x-r3r6
—org.xwiki.platform:xwiki-platform-security (Maven)13.10 to before 13.10.113.10.1Patch availableGHSA-gg53-wf5x-r3r6
  • xwiki-platform VendorXWiki Affected 5.0 to before 12.10.11; 13.0 to before 13.4.6; 13.10 to before 13.10.1 Fixed in 12.10.11, 13.4.6, 13.10.1 Patch available CNA
  • org.xwiki.platform:xwiki-platform-security (Maven) Vendor— Affected 5.0 to before 12.10.11 Fixed in 12.10.11 Patch available GHSA-gg53-wf5x-r3r6
  • org.xwiki.platform:xwiki-platform-security (Maven) Vendor— Affected 13.0 to before 13.4.6 Fixed in 13.4.6 Patch available GHSA-gg53-wf5x-r3r6
  • org.xwiki.platform:xwiki-platform-security (Maven) Vendor— Affected 13.10 to before 13.10.1 Fixed in 13.10.1 Patch available GHSA-gg53-wf5x-r3r6

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*5.0 to before 12.10.11; 13.0 to before 13.4.6; 13.5 to before 13.10.1VulnerableXWiki
  • cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:* Versions 5.0 to before 12.10.11; 13.0 to before 13.4.6; 13.5 to before 13.10.1 Vulnerable ·XWiki

Remediation

  • Fix · CNA xwiki-platform (xwiki) Fixed in 12.10.11, 13.4.6, 13.10.1
  • Fix · GHSA-gg53-wf5x-r3r6 org.xwiki.platform:xwiki-platform-security (Maven) Fixed in 12.10.11 Advisory →
  • Fix · GHSA-gg53-wf5x-r3r6 org.xwiki.platform:xwiki-platform-security (Maven) Fixed in 13.4.6 Advisory →
  • Fix · GHSA-gg53-wf5x-r3r6 org.xwiki.platform:xwiki-platform-security (Maven) Fixed in 13.10.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-31167
  2. 2026-10-03 Alias added: GHSA-gg53-wf5x-r3r6

References

Exploit 2

Advisory 2

Other 1

  • TI-2025-18595 Remote code execution as guest via SolrSearchMacros request in xwiki KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-25214 Remote code execution through the section parameter in Administration as guest in XWiki Platform CVSS 3.1CRITICAL 10.0
  • TI-2025-23500 XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter CVSS 4.0CRITICAL 9.3
  • TI-2025-23979 org.xwiki.platform:xwiki-platform-rest-server allows SQL injection in query endpoint of REST API CVSS 4.0CRITICAL 9.3
  • TI-2024-20829 XWiki Platform: Remote code execution from account via SearchSuggestSourceSheet CVSS 3.1CRITICAL 10.0
  • TI-2024-14375 XWiki Remote Code Execution vulnerability via user registration CVSS 3.1CRITICAL 10.0
See all 247 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences