CVE-2022-24821

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Simple users can create global SSX/JSX without specific rights: in theory only users with Programming Rights should be allowed to create SSX or JSX that are executed everywhere on a wiki. But a bug allow anyone with edit rights to actually create those. This issue has been patched in XWiki 13.10-rc-1, 12.10.11 and 13.4.6. There's no easy workaround for this issue, administrators should upgrade their wiki.

• CWE-648

• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-ghcq-472w-vf4hThird Party Advisory
• https://jira.xwiki.org/browse/XWIKI-19155Exploit, Issue Tracking, Patch, Third Party Advisory
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-ghcq-472w-vf4hThird Party Advisory
• https://jira.xwiki.org/browse/XWIKI-19155Exploit, Issue Tracking, Patch, Third Party Advisory

Published

Apr 8, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-24816JAI-EXT is an open-source project which aims to extend the J…10
• CVE-2022-24817Flux2 is an open and extensible continuous delivery solution…9.9
• CVE-2022-24818GeoTools is an open source Java library that provides tools …7.2
• CVE-2022-24819XWiki Platform is a generic wiki platform offering runtime s…5.3
• CVE-2022-2482 A vulnerability exists in Nokia’s ASIK AirScale system modu…8.8
• CVE-2022-24820XWiki Platform is a generic wiki platform offering runtime s…5.3
• CVE-2022-24822Podium is a library for building micro frontends. @podium/la…7.5
• CVE-2022-24823Netty is an open-source, asynchronous event-driven network a…5.5
• CVE-2022-24824Discourse is an open source platform for community discussio…5.3
• CVE-2022-24825Smokescreen is a simple HTTP proxy that fogs over naughty UR…5.3
• CVE-2022-24826On Windows, if Git LFS operates on a malicious repository wi…7.8
• CVE-2022-24827Elide is a Java library that lets you stand up a GraphQL/JSO…8.1