What is GHSA-4x5r-6v26-7j4v?

GHSA-4x5r-6v26-7j4v is a security advisory published by GitHub Security Advisories with High severity. Creation of new database tables through login form on PostgreSQL

Which CVE IDs does GHSA-4x5r-6v26-7j4v cover?

GHSA-4x5r-6v26-7j4v covers the following CVE IDs: CVE-2022-41932. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-4x5r-6v26-7j4v?

GHSA-4x5r-6v26-7j4v has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-4x5r-6v26-7j4v?

GHSA-4x5r-6v26-7j4v affects 3 products, including: maven/org.xwiki.platform:xwiki-platform-oldcore:\u003c 13.10.8; maven/org.xwiki.platform:xwiki-platform-oldcore:\u003e= 14.0.0, \u003c 14.4.2; maven/org.xwiki.platform:xwiki-platform-oldcore:\u003e= 14.5.0, \u003c 14.6-rc-1.

GHSA-4x5r-6v26-7j4vHighCVSS 7.5

Creation of new database tables through login form on PostgreSQL

Vendor

GitHub Security Advisories

Published

November 21, 2022

Last Modified

July 10, 2023

🔗 CVE IDs covered (1)

CVE-2022-41932 →

📋 Description

Impact

It's possible to make XWiki create many new schemas and fill them with tables just by using a crafted user identifier in the login form.

Patches

The problem has been patched in XWiki 13.10.8, 14.6RC1 and 14.4.2.

Workarounds

The only workarounds for this are:

use an authenticator which does interpret the login as a reference to a document
using a different database than PostgreSQL
upgrade XWiki

References

https://jira.xwiki.org/browse/XWIKI-19886

For more information

If you have any questions or comments about this advisory:

Open an issue in Jira XWiki.org
Email us at Security Mailing List

🎯 Affected products3

maven/org.xwiki.platform:xwiki-platform-oldcore:< 13.10.8
maven/org.xwiki.platform:xwiki-platform-oldcore:>= 14.0.0, < 14.4.2
maven/org.xwiki.platform:xwiki-platform-oldcore:>= 14.5.0, < 14.6-rc-1