TI-2022-20271 Aliases CVE-2022-41930 GHSA-p5v9-g8w8-5q4v

org.xwiki.platform:xwiki-platform-user-profile-ui missing authorization to enable or disable users

HIGH 75CWE-862Published 2022-11-23 · Updated 2025-04-22

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: None · High · Low
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-862.

Summary

org.xwiki.platform:xwiki-platform-user-profile-ui is missing authorization to enable or disable users. Any user (logged in or not) with access to the page XWiki.XWikiUserProfileSheet can enable or disable any user profile. This might allow to a disabled user to re-enable themselves, or to an attacker to disable any user of the wiki. The problem has been patched in XWiki 13.10.7, 14.5RC1 and 14.4.2. Workarounds: The problem can be patched immediately by editing the page `XWiki.XWikiUserProfileSheet` in the wiki and by performing the changes contained in https://github.com/xwiki/xwiki-platform/commit/5be1cc0adf917bf10899c47723fa451e950271fa.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00903 59th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed xwiki-platform (xwiki): 13.10.7, 14.4.2org.xwiki.platform:xwiki-platform-user-profile-ui (Maven): 13.10.7, 14.4.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
XWiki	xwiki-platform	12.4 to before 13.10.7; 14.0.0 to before 14.4.2	13.10.7, 14.4.2	Patch available	CNA
—	org.xwiki.platform:xwiki-platform-user-profile-ui (Maven)	12.4 to before 13.10.7	13.10.7	Patch available	GHSA-p5v9-g8w8-5q4v
—	org.xwiki.platform:xwiki-platform-user-profile-ui (Maven)	14.0.0 to before 14.4.2	14.4.2	Patch available	GHSA-p5v9-g8w8-5q4v

xwiki-platform VendorXWiki Affected 12.4 to before 13.10.7; 14.0.0 to before 14.4.2 Fixed in 13.10.7, 14.4.2 Patch available CNA
org.xwiki.platform:xwiki-platform-user-profile-ui (Maven) Vendor— Affected 12.4 to before 13.10.7 Fixed in 13.10.7 Patch available GHSA-p5v9-g8w8-5q4v
org.xwiki.platform:xwiki-platform-user-profile-ui (Maven) Vendor— Affected 14.0.0 to before 14.4.2 Fixed in 14.4.2 Patch available GHSA-p5v9-g8w8-5q4v

CPE configurations NVD · 3

CPE	Versions	Role	Vendor
cpe:2.3:a:xwiki:xwiki::::::::	12.4 to before 13.10.7; 14.0.0 to before 14.4.2	Vulnerable	XWiki
cpe:2.3:a:xwiki:xwiki:14.4.3:::::::*	14.4.3	Vulnerable	XWiki
cpe:2.3:a:xwiki:xwiki:14.4.4:::::::*	14.4.4	Vulnerable	XWiki

cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:* Versions 12.4 to before 13.10.7; 14.0.0 to before 14.4.2 Vulnerable ·XWiki
cpe:2.3:a:xwiki:xwiki:14.4.3:*:*:*:*:*:*:* Versions 14.4.3 Vulnerable ·XWiki
cpe:2.3:a:xwiki:xwiki:14.4.4:*:*:*:*:*:*:* Versions 14.4.4 Vulnerable ·XWiki

Remediation

Fix · CNA xwiki-platform (xwiki) Fixed in 13.10.7, 14.4.2
Fix · GHSA-p5v9-g8w8-5q4v org.xwiki.platform:xwiki-platform-user-profile-ui (Maven) Fixed in 13.10.7 Advisory →
Fix · GHSA-p5v9-g8w8-5q4v org.xwiki.platform:xwiki-platform-user-profile-ui (Maven) Fixed in 14.4.2 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2022-41930
2026-10-03 Alias added: GHSA-p5v9-g8w8-5q4v

References

Exploit 1

https://jira.xwiki.org/browse/XWIKI-19792

Patch 2

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2022-41930

Other 1

https://github.com/xwiki/xwiki-platform

TI-2025-18595 Remote code execution as guest via SolrSearchMacros request in xwiki KEVCVSS 3.1CRITICAL 9.8
TI-2023-25214 Remote code execution through the section parameter in Administration as guest in XWiki Platform CVSS 3.1CRITICAL 10.0
TI-2025-23500 XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter CVSS 4.0CRITICAL 9.3
TI-2025-23979 org.xwiki.platform:xwiki-platform-rest-server allows SQL injection in query endpoint of REST API CVSS 4.0CRITICAL 9.3
TI-2024-20829 XWiki Platform: Remote code execution from account via SearchSuggestSourceSheet CVSS 3.1CRITICAL 10.0
TI-2024-14375 XWiki Remote Code Execution vulnerability via user registration CVSS 3.1CRITICAL 10.0

See all 247 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences