CVE-2022-41929 MEDIUM

CVE-2022-41929: Missing Authorization in User#setDisabledStatus in org.xwiki.platform:xwiki-platform-oldcore

Vendor Xwiki
Product xwiki-platform
Weakness CWE-862 · Missing authorization
Published November 23, 2022
Last update April 22, 2025
View on NVD All CVEs

CVSS base score

4.9/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality None
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

What the vulnerability does

01Description

org.xwiki.platform:xwiki-platform-oldcore is missing authorization in User#setDisabledStatus, which may allow an incorrectly authorized user with only Script rights to enable or disable a user. This operation is meant to only be available for users with admin rights. This problem has been patched in XWiki 13.10.7, 14.4.2 and 14.5RC1.

Key dates

02Disclosure timeline

November 23, 2022 CVE published
April 22, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-57335 WordPress Ads by WPQuads plugin <= 3.0.3 - Broken Access Control vulnerability CVE-2026-57949 ruoyi-vue-pro - Missing Authorization in CRM Follow-up Record GET Endpoint CVE-2026-57688 WordPress POS Entegratör plugin <= 3.7.103 - Broken Access Control vulnerability CVE-2026-57954 Elide 7.1.17 - Permission Bypass in Sort Expression Validation CVE-2026-58377 JeecgBoot 3.9.2 - Missing Authorization on OpenAPI Credential Management Endpoints Exposes Access/Secret Keys