CVE-2022-24821

Name: CVE-2022-24821
Creator: NVD / NIST
Published: 2022-04-08T19:15:08.257+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

HIGHCVSS 8.1/10EPSS 0.79%

Last modified Jun 17, 2026

CVE-2022-24821 is a high-severity vulnerability rated 8.1/10 on the CVSS scale. XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Simple users can create global SSX/JSX without specific rights: in theory only users with Programming Rights should be allowed to create SSX or JSX that are executed everywhere on a wiki. EPSS estimates a 0.79% chance of exploitation in the next 30 days.

Description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Simple users can create global SSX/JSX without specific rights: in theory only users with Programming Rights should be allowed to create SSX or JSX that are executed everywhere on a wiki. But a bug allow anyone with edit rights to actually create those. This issue has been patched in XWiki 13.10-rc-1, 12.10.11 and 13.4.6. There's no easy workaround for this issue, administrators should upgrade their wiki.

Metrics

CVSS 3.1

8.1/10

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

EPSS Probability

0.79%

51.6th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-648

Affected Software

Vendor	Product	Versions
Xwiki	Xwiki	>= 12.0.0, < 12.10.11
Xwiki	Xwiki	>= 13.4.0, < 13.4.6
Xwiki	Xwiki	13.10

References

https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-ghcq-472w-vf4hThird Party Advisory
https://jira.xwiki.org/browse/XWIKI-19155Exploit, Issue Tracking, Patch, Third Party Advisory
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-ghcq-472w-vf4hThird Party Advisory
https://jira.xwiki.org/browse/XWIKI-19155Exploit, Issue Tracking, Patch, Third Party Advisory

Timeline

Published: Apr 8, 2022
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2022-24821?

How severe is CVE-2022-24821?

CVE-2022-24821 has a CVSS score of 8.1/10 (HIGH severity). The EPSS model estimates a 0.79% probability of exploitation in the next 30 days.

How do I fix CVE-2022-24821?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2022-24821?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST