{"id":"CVE-2022-36092","summary":"XWiki Platform Old Core vulnerable to Authentication Bypass Using the Login Action","details":"XWiki Platform Old Core is a core package for XWiki Platform, a generic wiki platform. Prior to versions 14.2 and 13.10.4, all rights checks that would normally prevent a user from viewing a document on a wiki can be bypassed using the login action and directly specified templates. This exposes title, content and comments of any document and properties of objects, though class and property name must be known. This is also exploitable on private wikis. This has been patched in versions 14.2 and 13.10.4 by properly checking view rights before loading documents and disallowing non-default templates in the login, registration and skin action. As a workaround, it would be possible to protect all templates individually by adding code to check access rights first.","aliases":["GHSA-8h89-34w2-jpfm"],"modified":"2026-09-10T09:42:41.833913Z","published":"2022-09-08T17:15:15Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36092.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-287"]},"references":[{"type":"WEB","url":"https://jira.xwiki.org/browse/XWIKI-18602"},{"type":"WEB","url":"https://jira.xwiki.org/browse/XWIKI-19549"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36092.json"},{"type":"ADVISORY","url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-8h89-34w2-jpfm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-36092"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/71a6d0bb6f8ab718fcfaae0e9b8c16c2d69cd4bb"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/9b7057d57a941592d763992d4299456300918208"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/xwiki/xwiki-commons","events":[{"introduced":"0"},{"fixed":"3c4c45dbd8604be3d2e0c255fae73e3800bf1b13"},{"introduced":"491547c4f74b9be58123ef22081ae7e6840a11c7"},{"fixed":"57b99a782759720697322902b6e3c85b8eb26f14"}],"database_specific":{"cpe":"cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"13.10.4"},{"introduced":"14.0"},{"fixed":"14.2"}],"source":"CPE_RANGE"}},{"type":"GIT","repo":"https://github.com/xwiki/xwiki-platform","events":[{"introduced":"0"},{"fixed":"9e6485fbdb9eee07a0753df63cbe20f0960b3770"},{"introduced":"d971304b0e0bf4f6dad278de89518edc17459741"},{"fixed":"cb76b3247520065eadd38376d57ba0043bc5bf00"},{"fixed":"71a6d0bb6f8ab718fcfaae0e9b8c16c2d69cd4bb"},{"fixed":"9b7057d57a941592d763992d4299456300918208"}],"database_specific":{"cpe":"cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"13.10.4"},{"introduced":"14.0"},{"fixed":"14.2"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["xwiki-commons-14.2-rc-1","xwiki-commons-13.10.3","xwiki-commons-13.10.2","xwiki-commons-13.10.1","xwiki-commons-13.10","xwiki-commons-13.10-rc-1","xwiki-commons-8.3-milestone-2","xwiki-commons-8.3-milestone-1","xwiki-commons-8.2-milestone-2","xwiki-commons-8.2-milestone-1","xwiki-commons-8.1-milestone-2","xwiki-commons-8.1-milestone-1","xwiki-commons-8.0-milestone-2","xwiki-commons-8.0-milestone-1","xwiki-platform-14.2-rc-1","xwiki-platform-13.10.3","xwiki-platform-13.10.2","xwiki-platform-13.10.1","xwiki-platform-13.10","xwiki-platform-13.10-rc-1","xwiki-platform-9.9-rc-2","xwiki-platform-8.3-milestone-1","xwiki-platform-8.2-milestone-2","xwiki-platform-8.2-milestone-1","xwiki-platform-8.1-milestone-2","xwiki-platform-8.1-milestone-1","xwiki-platform-8.0-milestone-2","xwiki-platform-8.0-milestone-1","xwiki-platform-7.4-milestone-2","xwiki-platform-7.4-milestone-1","xwiki-platform-7.3-milestone-2"],"database_specific":{"vanir_signatures_modified":"2026-09-10T09:42:41Z","vanir_signatures":[{"id":"CVE-2022-36092-1e5943f4","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/9b7057d57a941592d763992d4299456300918208","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/web/RegisterAction.java","function":"action"},"deprecated":false,"digest":{"function_hash":"129858878663514744583654613546158858691","length":1054}},{"id":"CVE-2022-36092-2125d9f0","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/71a6d0bb6f8ab718fcfaae0e9b8c16c2d69cd4bb","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/web/LoginErrorAction.java","function":"render"},"deprecated":false,"digest":{"function_hash":"290951439554817580629288229862984976915","length":73}},{"target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/web/SkinAction.java","function":"render"},"deprecated":false,"digest":{"function_hash":"12620936998958339819645522159285315930","length":227},"id":"CVE-2022-36092-46ebf23c","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/71a6d0bb6f8ab718fcfaae0e9b8c16c2d69cd4bb"},{"deprecated":false,"digest":{"function_hash":"92936970513355401189768925734204185328","length":195},"id":"CVE-2022-36092-53e05d0b","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/71a6d0bb6f8ab718fcfaae0e9b8c16c2d69cd4bb","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/web/LoginAction.java","function":"render"}},{"id":"CVE-2022-36092-6413dd66","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/71a6d0bb6f8ab718fcfaae0e9b8c16c2d69cd4bb","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/web/RegisterAction.java"},"deprecated":false,"digest":{"line_hashes":["129741798568835193545519230161513052116","248441858526514497857581308984228593642","289836569577659662753945271606289797530"],"threshold":0.9}},{"source":"https://github.com/xwiki/xwiki-platform/commit/71a6d0bb6f8ab718fcfaae0e9b8c16c2d69cd4bb","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/XWiki.java"},"deprecated":false,"digest":{"line_hashes":["228722021646907852147601064371816417166","309893147895295623006678677505914088948","296949392936102305018749420429708858673","79779056127460637435062281877392531978","159118855138867057820020552109526880545","96229704121027180594531059620055387703","258778771745396362684712780689570946208","321927589465859195389820267425105146941","152144373543547686191492535433211320740","35838872189371855404255005145611518390","4052869112836908288621775348375378334","198671997787842484133686533449592832776","302801264038260864224859171562219418372","3965168309518567409961215106832879383","212384403258689564736687815310058263049","15799800441770470322558449160171332280","141090657238910517911352431810003301380","64647879369216900541248089782184566778","87544493954714933080708187203969350359","163425526095659632715769973333750256818","35788842022087045123609167469769150123","14660042912638954110072286275525639622"],"threshold":0.9},"id":"CVE-2022-36092-79597ce0","signature_type":"Line","signature_version":"v1"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/71a6d0bb6f8ab718fcfaae0e9b8c16c2d69cd4bb","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/web/LoginErrorAction.java"},"deprecated":false,"digest":{"line_hashes":["205102867196807242750029202956339919662","185838120143568738867783751224042034062","247560934255644735119601249642627499757","196964425332799933792019260519525495234","289940823145706513894867888268227353968","335120901962831214955874712757936282497","303469427591486454762439135435334774358"],"threshold":0.9},"id":"CVE-2022-36092-7f83223e"},{"deprecated":false,"digest":{"function_hash":"169314351788692781451429070747690618935","length":787},"id":"CVE-2022-36092-93521f8f","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/71a6d0bb6f8ab718fcfaae0e9b8c16c2d69cd4bb","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/web/RegisterAction.java","function":"action"}},{"digest":{"function_hash":"76866126606115470955963545866846705145","length":1437},"id":"CVE-2022-36092-952f142d","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/71a6d0bb6f8ab718fcfaae0e9b8c16c2d69cd4bb","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/web/SkinAction.java","function":"render"},"deprecated":false},{"id":"CVE-2022-36092-af3cb26c","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/71a6d0bb6f8ab718fcfaae0e9b8c16c2d69cd4bb","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/web/SkinAction.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["46124437662527452649691640037286549559","154753768410379500217920907306906565625","19804179982290288445347343110841940335","1026720116172649524953639793169595414","25291363707261908575500781484274799223","120913902133190361057581455359581393459","47456674116260542673095577421937899361","48701598696584742782219278464301757100","109056058933282594909472878419319127715","281523694881093520070833364555892981870","282195552530682514852257061878044123729","260394261645276105957753980367153488841","321786245635659677300815405538519920082","327427202600406253588452603017173724842","330470461897248301351101071645955343363"]}},{"target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/XWiki.java","function":"prepareDocuments"},"deprecated":false,"digest":{"function_hash":"234721490795059091220789009001135400855","length":3672},"id":"CVE-2022-36092-b0f58eb6","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/71a6d0bb6f8ab718fcfaae0e9b8c16c2d69cd4bb"},{"signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/71a6d0bb6f8ab718fcfaae0e9b8c16c2d69cd4bb","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/web/LoginSubmitAction.java"},"deprecated":false,"digest":{"line_hashes":["233332251243304210654386443201254986869","310654350099606346379510137511927665639","64629888236980799467021377344515030503","196964425332799933792019260519525495234","98944944143130069284698966093920129334","31708310454332351377900339045350273580","216784920352055109888462277686677890082"],"threshold":0.9},"id":"CVE-2022-36092-b218b70b","signature_type":"Line"},{"deprecated":false,"digest":{"line_hashes":["268624534721901109969900642748275712521","16267864954555696775901063581924878608","221937407299456018465347909779203501242","290227683120102332345678285949702745898","35431012928724617952791434785852362512","161871488577282215721188722034575691825","65799251440383524869600222348284625436","92026457223176878232958923719152781764","107719823167413687610830195007257793848","166922423600362957048532470885268915176"],"threshold":0.9},"id":"CVE-2022-36092-bab815fe","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/9b7057d57a941592d763992d4299456300918208","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/web/RegisterAction.java"}},{"id":"CVE-2022-36092-c3aa0687","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/71a6d0bb6f8ab718fcfaae0e9b8c16c2d69cd4bb","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/web/LoginAction.java"},"deprecated":false,"digest":{"line_hashes":["180779849631488952180149728061634777179","96675754632867215347754697473477568995","157258088345616920533881466406792500343","25400634590730898626523997741880507946","108528306601871024792342374168286190331","217388699667895560558207770105824210962","62611156957476029916158049957341141037","48811371396501015343292239236447810032","286425907000469837085487031348115535824","216784920352055109888462277686677890082"],"threshold":0.9}},{"source":"https://github.com/xwiki/xwiki-platform/commit/71a6d0bb6f8ab718fcfaae0e9b8c16c2d69cd4bb","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/web/LoginSubmitAction.java","function":"render"},"deprecated":false,"digest":{"function_hash":"75484395089046896113766431448288592295","length":243},"id":"CVE-2022-36092-ec7f5d91","signature_type":"Function","signature_version":"v1"}],"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-36092.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}]}