CVE-2022-24821
Incorrect Use of Privileged APIs in org.xwiki.platform.skin.skinx
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Simple users can create global SSX/JSX without specific rights: in theory only users with Programming Rights should be allowed to create SSX or JSX that are executed everywhere on a wiki. But a bug allow anyone with edit rights to actually create those. This issue has been patched in XWiki 13.10-rc-1, 12.10.11 and 13.4.6. There's no easy workaround for this issue, administrators should upgrade their wiki.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Incorrect Use of Privileged APIs in org.xwiki.platform.skin.skinx
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Simple users can create global SSX/JSX without specific rights: in theory only users with Programming Rights should be allowed to create SSX or JSX that are executed everywhere on a wiki. But a bug allow anyone with edit rights to actually create those. This issue has been patched in XWiki 13.10-rc-1, 12.10.11 and 13.4.6. There's no easy workaround for this issue, administrators should upgrade their wiki.
- Record
CVE-2022-24821- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N - Weakness
- CWE-648
- Updated
- 2026-11-02
EUVDEUVD-2022-1741
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Simple users can create global SSX/JSX without specific rights: in theory only users with Programming Rights should be allowed to create SSX or JSX that are executed everywhere on a wiki. But a bug allow anyone with edit rights to actually create those. This issue has been patched in XWiki 13.10-rc-1, 12.10.11 and 13.4.6. There's no easy workaround for this issue, administrators should upgrade their wiki.
- Record
EUVD-2022-1741- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-ghcq-472w-vf4h
Incorrect Use of Privileged APIs in org.xwiki.platform.skin.skinx
Impact
Simple users can create global SSX/JSX without specific rights: in theory only users with Programming Rights should be allowed to create SSX or JSX that are executed everywhere on a wiki. But a bug allow anyone with edit rights to actually create those.
Patches
This issue has been patched in XWiki 13.10-rc-1, 12.10.11 and 13.4.6.
Workarounds
There's no easy workaround for this issue, administrators should upgrade their wiki.
References
https://jira.xwiki.org/browse/XWIKI-19155
For more information
If you have any questions or comments about this advisory:
- Open an issue in JIRA
- Email us at XWiki Security ML
- Record
GHSA-ghcq-472w-vf4h- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N - Weakness
- CWE-648
- Updated
- 2026-11-02
NVD
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Simple users can create global SSX/JSX without specific rights: in theory only users with Programming Rights should be allowed to create SSX or JSX that are executed everywhere on a wiki. But a bug allow anyone with edit rights to actually create those. This issue has been patched in XWiki 13.10-rc-1, 12.10.11 and 13.4.6. There's no easy workaround for this issue, administrators should upgrade their wiki.
- Record
CVE-2022-24821- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N - CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - CVSS 2.0
- 5.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:N - Weakness
- CWE-648
- Updated
- 2026-11-02
OSV
Incorrect Use of Privileged APIs in org.xwiki.platform.skin.skinx
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Simple users can create global SSX/JSX without specific rights: in theory only users with Programming Rights should be allowed to create SSX or JSX that are executed everywhere on a wiki. But a bug allow anyone with edit rights to actually create those. This issue has been patched in XWiki 13.10-rc-1, 12.10.11 and 13.4.6. There's no easy workaround for this issue, administrators should upgrade their wiki.
- Record
CVE-2022-24821- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N - Weakness
- CWE-648
- Updated
- 2026-11-02
OSVGHSA-ghcq-472w-vf4h
Incorrect Use of Privileged APIs in org.xwiki.platform.skin.skinx
Impact
Simple users can create global SSX/JSX without specific rights: in theory only users with Programming Rights should be allowed to create SSX or JSX that are executed everywhere on a wiki. But a bug allow anyone with edit rights to actually create those.
Patches
This issue has been patched in XWiki 13.10-rc-1, 12.10.11 and 13.4.6.
Workarounds
There's no easy workaround for this issue, administrators should upgrade their wiki.
References
https://jira.xwiki.org/browse/XWIKI-19155
For more information
If you have any questions or comments about this advisory:
- Open an issue in JIRA
- Email us at XWiki Security ML
- Record
GHSA-ghcq-472w-vf4h- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N - Weakness
- CWE-648
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.xwiki.platform:xwiki-platform-skin-skinxMaven |
13.5.0 up to 13.10 | 13.10 |
org.xwiki.platform:xwiki-platform-skin-skinxMaven |
before 12.10.11 | 12.10.11 |
org.xwiki.platform:xwiki-platform-skin-skinxMaven |
13.0.0 up to 13.4.6 | 13.4.6 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-24821 is a medium vulnerability (CVSS 6.8) in Xwiki, published April 8, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.80%, the 57th percentile. Fixed in org.xwiki.platform:xwiki-platform-skin-skinx 13.10.