CVE-2022-41932 HIGH

CVE-2022-41932: Creation of new database tables through login form on PostgreSQL

Vendor Xwiki
Product xwiki-platform
Weakness CWE-400
Published November 23, 2022
Last update April 23, 2025
View on NVD All CVEs

CVSS base score

7.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

What the vulnerability does

01Description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to make XWiki create many new schemas and fill them with tables just by using a crafted user identifier in the login form. This may lead to degraded database performance. The problem has been patched in XWiki 13.10.8, 14.6RC1 and 14.4.2. Users are advised to upgrade. There are no known workarounds for this issue.

Key dates

02Disclosure timeline

November 23, 2022 CVE published
April 23, 2025 Record updated