CVE-2022-23616

    Dashboard / Vulnerabilities / CVE-2022-23616

    CVE-2022-23616

    Published: 9 Feb 2022Last Modified: 12 Aug 2026

    Summary: Remote code execution in xwiki-platform

    Details: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible for an unprivileged user to perform a remote code execution by injecting a groovy script in her own profile and by calling the Reset password feature since the feature is performing a save of the user profile with programming rights in the impacted versions of XWiki. The issue has been patched in XWiki 13.1RC1. There are two different possible workarounds, each consisting of modifying the XWiki/ResetPassword page. 1. The Reset password feature can be entirely disabled by deleting the XWiki/ResetPassword page. 2. The script in XWiki/ResetPassword can also be modified or removed: an administrator can replace it with a simple email contact to ask an administrator to reset the password.

    References: https://jira.xwiki.org/browse/XWIKI-16661, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23616.json, https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-mgjw-2wrp-r535, https://nvd.nist.gov/vuln/detail/CVE-2022-23616

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- c62740b018828e1dec52107f480f4cda14776528
    Fixed -None

    Affected versions

    3.1-milestone2

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-23616 | CVE-DB