VYPR
Get started
← All advisories
Moderate severityNVD Advisory· Published Feb 9, 2022· Updated Apr 23, 2025

Partial authorization bypass on document save in xwiki-platform

CVE-2022-23615

Description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with SCRIPT right can save a document with the right of the current user which allow accessing API requiring programming right if the current user has programming right. This has been patched in XWiki 13.0. Users are advised to update to resolve this issue. The only known workaround is to limit SCRIPT access.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.xwiki.platform:xwiki-platform-oldcoreMaven
>= 1.0, < 13.013.0

Affected products

1

Patches

1
7ab0fe7b9680

XWIKI-5024: Document potentially saved with the wrong author

https://github.com/xwiki/xwiki-platformThomas MortagneJan 19, 2021via ghsa
commit
2 files changed · +22 −2
  • xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/api/Document.java+14 −1 modified
    @@ -37,6 +37,7 @@
 import org.suigeneris.jrcs.diff.DifferentiationFailedException;
 import org.suigeneris.jrcs.diff.delta.Delta;
 import org.suigeneris.jrcs.rcs.Version;
+import org.xwiki.configuration.ConfigurationSource;
 import org.xwiki.context.Execution;
 import org.xwiki.context.ExecutionContext;
 import org.xwiki.display.internal.DocumentDisplayerParameters;
@@ -69,6 +70,7 @@
 import com.xpn.xwiki.doc.XWikiDocumentArchive;
 import com.xpn.xwiki.doc.XWikiLink;
 import com.xpn.xwiki.doc.XWikiLock;
+import com.xpn.xwiki.internal.XWikiCfgConfigurationSource;
 import com.xpn.xwiki.objects.BaseObject;
 import com.xpn.xwiki.objects.BaseProperty;
 import com.xpn.xwiki.objects.ObjectDiff;
@@ -132,6 +134,8 @@ public class Document extends Api
 
     private DocumentRevisionProvider documentRevisionProvider;
 
+    private ConfigurationSource configuration;
+
     private DocumentReferenceResolver<String> getCurrentMixedDocumentReferenceResolver()
     {
         if (this.currentMixedDocumentReferenceResolver == null) {
@@ -179,6 +183,15 @@ private DocumentRevisionProvider getDocumentRevisionProvider()
         return this.documentRevisionProvider;
     }
 
+    private ConfigurationSource getConfiguration()
+    {
+        if (this.configuration == null) {
+            this.configuration = Utils.getComponent(ConfigurationSource.class);
+        }
+
+        return this.configuration;
+    }
+
     /**
      * Document constructor.
      *
@@ -2537,7 +2550,7 @@ public void save(String comment, boolean minorEdit) throws XWikiException
         if (hasAccessLevel("edit")) {
             // If the current author does not have PR don't let it set current user as author of the saved document
             // since it can lead to right escalation
-            if (hasProgrammingRights()) {
+            if (hasProgrammingRights() || !getConfiguration().getProperty("security.script.save.checkAuthor", true)) {
                 saveDocument(comment, minorEdit);
             } else {
                 saveAsAuthor(comment, minorEdit);
  • xwiki-platform-tools/xwiki-platform-tool-configuration-resources/src/main/resources/xwiki.properties.vm+8 −1 modified
    @@ -664,6 +664,13 @@ extension.versioncheck.environment.enabled=$xwikiPropertiesEnvironmentVersionChe
 #-# The default is:
 # security.authorization.settler=default
 
+#-# [Since 13.0]
+#-# Control if document save API should also check the right of the script author when saving a document.
+#-# When false only the current user right is checked.
+#-#
+#-# The default is:
+# security.script.save.checkAuthor=true
+
 #-------------------------------------------------------------------------------------
 # URL
 #-------------------------------------------------------------------------------------
@@ -1185,4 +1192,4 @@ edit.defaultEditor.org.xwiki.rendering.block.XDOM#wysiwyg=$xwikiPropertiesDefaul
 #-# The default value is:
 # skinx.jsStrictModeEnabled = false
 
-$!xwikiPropertiesAdditionalProperties
\ No newline at end of file
+$!xwikiPropertiesAdditionalProperties

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.