Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-qt8r-6rqv-tkhu
Vulnerability ID VCID-qt8r-6rqv-tkhu
Aliases CVE-2022-23621
GHSA-2jhm-qp48-hv5j
Summary Missing Authorization XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with SCRIPT right can read any file located in the XWiki WAR (for example xwiki.cfg and xwiki.properties) through XWiki#invokeServletAndReturnAsString as `$xwiki.invokeServletAndReturnAsString("/WEB-INF/xwiki.cfg")`. This issue has been patched in XWiki versions 12.10.9, 13.4.3 and 13.7-rc-1. Users are advised to update. The only workaround is to limit SCRIPT right.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-862 Missing Authorization
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-552 Files or Directories Accessible to External Parties
System Score Found at
epss 0.00105 https://api.first.org/data/v1/epss?cve=CVE-2022-23621
epss 0.00105 https://api.first.org/data/v1/epss?cve=CVE-2022-23621
epss 0.00105 https://api.first.org/data/v1/epss?cve=CVE-2022-23621
epss 0.00105 https://api.first.org/data/v1/epss?cve=CVE-2022-23621
epss 0.00105 https://api.first.org/data/v1/epss?cve=CVE-2022-23621
epss 0.00105 https://api.first.org/data/v1/epss?cve=CVE-2022-23621
epss 0.00105 https://api.first.org/data/v1/epss?cve=CVE-2022-23621
epss 0.00105 https://api.first.org/data/v1/epss?cve=CVE-2022-23621
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-2jhm-qp48-hv5j
cvssv3.1 5.5 https://github.com/xwiki/xwiki-platform
generic_textual MODERATE https://github.com/xwiki/xwiki-platform
cvssv3.1 5.5 https://github.com/xwiki/xwiki-platform/commit/df8bd49b5a4d87a427002c6535fb5b1746ff117a
generic_textual MODERATE https://github.com/xwiki/xwiki-platform/commit/df8bd49b5a4d87a427002c6535fb5b1746ff117a
cvssv3.1 5.5 https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-2jhm-qp48-hv5j
cvssv3.1_qr MODERATE https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-2jhm-qp48-hv5j
generic_textual MODERATE https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-2jhm-qp48-hv5j
cvssv3.1 5.5 https://jira.xwiki.org/browse/XWIKI-18870
generic_textual MODERATE https://jira.xwiki.org/browse/XWIKI-18870
cvssv3.1 5.5 https://nvd.nist.gov/vuln/detail/CVE-2022-23621
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2022-23621
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2022-23621
https://github.com/xwiki/xwiki-platform
https://github.com/xwiki/xwiki-platform/commit/df8bd49b5a4d87a427002c6535fb5b1746ff117a
https://jira.xwiki.org/browse/XWIKI-18870
CVE-2022-23621 https://nvd.nist.gov/vuln/detail/CVE-2022-23621
GHSA-2jhm-qp48-hv5j https://github.com/advisories/GHSA-2jhm-qp48-hv5j
GHSA-2jhm-qp48-hv5j https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-2jhm-qp48-hv5j
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H Found at https://github.com/xwiki/xwiki-platform
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H Found at https://github.com/xwiki/xwiki-platform/commit/df8bd49b5a4d87a427002c6535fb5b1746ff117a
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H Found at https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-2jhm-qp48-hv5j
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H Found at https://jira.xwiki.org/browse/XWIKI-18870
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2022-23621
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.28714
EPSS Score 0.00105
Published At April 2, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T12:49:27.339331+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.xwiki.platform/xwiki-platform-oldcore/CVE-2022-23621.yml 38.0.0