CVE-2022-36092

XWiki Platform Old Core is a core package for XWiki Platform, a generic wiki platform. Prior to versions 14.2 and 13.10.4, all rights checks that would normally prevent a user from viewing a document on a wiki can be bypassed using the login action and directly specified templates. This exposes title, content and comments of any document and properties of objects, though class and property name must be known. This is also exploitable on private wikis. This has been patched in versions 14.2 and 13.10.4 by properly checking view rights before loading documents and disallowing non-default templates in the login, registration and skin action. As a workaround, it would be possible to protect all templates individually by adding code to check access rights first.

• CWE-287

• https://github.com/xwiki/xwiki-platform/commit/71a6d0bb6f8ab718fcfaae0e9b8c16c2d69cd4bbPatch, Third Party Advisory
• https://github.com/xwiki/xwiki-platform/commit/9b7057d57a941592d763992d4299456300918208Patch, Third Party Advisory
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-8h89-34w2-jpfmThird Party Advisory
• https://jira.xwiki.org/browse/XWIKI-18602Vendor Advisory
• https://jira.xwiki.org/browse/XWIKI-19549Vendor Advisory
• https://github.com/xwiki/xwiki-platform/commit/71a6d0bb6f8ab718fcfaae0e9b8c16c2d69cd4bbPatch, Third Party Advisory
• https://github.com/xwiki/xwiki-platform/commit/9b7057d57a941592d763992d4299456300918208Patch, Third Party Advisory
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-8h89-34w2-jpfmThird Party Advisory
• https://jira.xwiki.org/browse/XWIKI-18602Vendor Advisory
• https://jira.xwiki.org/browse/XWIKI-19549Vendor Advisory

Published

Sep 8, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-36087OAuthLib is an implementation of the OAuth request-signing l…6.5
• CVE-2022-36088GoCD is a continuous delivery server. Windows installations …5.5
• CVE-2022-36089KubeVela is an application delivery platform Users using Kub…9.8
• CVE-2022-3609The GetYourGuide Ticketing WordPress plugin before 1.0.4 doe…4.8
• CVE-2022-36090XWiki Platform Old Core is a core package for XWiki Platform…8.1
• CVE-2022-36091XWiki Platform Web Templates are templates for XWiki Platfor…7.5
• CVE-2022-36093XWiki Platform Web Templates are templates for XWiki Platfor…7.1
• CVE-2022-36094XWiki Platform Web Parent POM contains Web resources for the…9
• CVE-2022-36095XWiki Platform is a generic wiki platform. Prior to versions…4.3
• CVE-2022-36096The XWiki Platform Index UI is an Index of all pages, attach…9
• CVE-2022-36097XWiki Platform Attachment UI provides a macro to easily uplo…6.1
• CVE-2022-36098XWiki Platform Mentions UI is a user interface for mentionin…9