{"id":"CVE-2022-41936","aliases":["EUVD-2022-7397","GHSA-p88w-fhxw-xvcc"],"status":"published","title":"Exposure of Private Personal Information to an Unauthorized Actor in xwiki-platform-rest-server","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The `modifications` rest endpoint does not filter out entries according to the user's rights. Therefore, information hidden from unauthorized users are exposed though the `modifications` rest endpoint (comments and page names etc). Users should upgrade to XWiki 14.6+, 14.4.3+, or 13.10.8+. Older versions have not been patched. There are no known workarounds.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00811,"percentile":0.57263,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-359"],"published":"2022-11-21T23:25:00Z","modified":"2026-10-28T10:31:28Z","fixes":[{"ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-rest-server","fixed_in":["13.10.8","14.4.3","14.6"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-rest-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1"},{"fixed":"13.10.8"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-rest-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14.0.0"},{"fixed":"14.4.3"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-rest-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14.5.0"},{"fixed":"14.6"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-rest-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1"},{"fixed":"13.10.8"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-rest-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14.0.0"},{"fixed":"14.4.3"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-rest-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14.5.0"},{"fixed":"14.6"}]}]}],"products":[{"vendor":"xwiki","product":"xwiki"},{"vendor":"xwiki","product":"xwiki-platform"}],"references":[{"url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-p88w-fhxw-xvcc","tags":["x_transferred","Patch","Third Party Advisory","advisory","web"]},{"url":"https://github.com/xwiki/xwiki-platform/commit/38dc1aa1a4435f24d58f5b8e4566cbcb0971f8ff","tags":["x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://jira.xwiki.org/browse/XWIKI-19997","tags":["x_transferred","Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-41936","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-p88w-fhxw-xvcc"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/41xxx/CVE-2022-41936.json","tags":["advisory"]},{"url":"https://github.com/xwiki/xwiki-platform","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-41936","title":"Exposure of Private Personal Information to an Unauthorized Actor in xwiki-platform-rest-server","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The `modifications` rest endpoint does not filter out entries according to the user's rights. Therefore, information hidden from unauthorized users are exposed though the `modifications` rest endpoint (comments and page names etc). Users should upgrade to XWiki 14.6+, 14.4.3+, or 13.10.8+. Older versions have not been patched. There are no known workarounds.","status":"published","published":"2022-11-22T00:00:00Z","modified":"2025-04-23T16:36:18.642Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-359"],"updated_at":"2026-11-02T14:34:28.038197Z"}],"euvd":[{"id":"EUVD-2022-7397","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The `modifications` rest endpoint does not filter out entries according to the user's rights. Therefore, information hidden from unauthorized users are exposed though the `modifications` rest endpoint (comments and page names etc). Users should upgrade to XWiki 14.6+, 14.4.3+, or 13.10.8+. Older versions have not been patched. There are no known workarounds.","status":"published","published":"2022-11-22T00:00:00Z","modified":"2025-04-23T16:36:18Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T20:52:12.313971Z"}],"ghsa":[{"id":"GHSA-p88w-fhxw-xvcc","title":"Exposure of Private Personal Information to an Unauthorized Actor in org.xwiki.platform:xwiki-platform-rest-server","description":"### Impact\nThe `modifications` rest endpoint does not filter out entries according to the user's rights. Therefore, information hidden from unauthorized users are exposed though the `modifications` rest endpoint (e.g., comments, page names...). \n\n### Patches\nUsers should upgrade to XWiki 14.6+, 14.4.3+,  or13.10.8+. Older versions have not been patched.\n\n### Workarounds\nNo known workaround.\n\n### References\n\n- Patch: https://github.com/xwiki/xwiki-platform/commit/38dc1aa1a4435f24d58f5b8e4566cbcb0971f8ff\n- Jira issue: https://jira.xwiki.org/browse/XWIKI-19997\n\n### For more information\nIf you have any questions or comments about this advisory:\n\n- Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)\n- Email us at [Security Mailing List](mailto:security@xwiki.org)\n","status":"published","published":"2022-11-21T23:25:00Z","modified":"2023-01-31T05:08:26Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-359"],"updated_at":"2026-11-02T14:36:29.957996Z"}],"nvd":[{"id":"CVE-2022-41936","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The `modifications` rest endpoint does not filter out entries according to the user's rights. Therefore, information hidden from unauthorized users are exposed though the `modifications` rest endpoint (comments and page names etc). Users should upgrade to XWiki 14.6+, 14.4.3+, or 13.10.8+. Older versions have not been patched. There are no known workarounds.","status":"published","published":"2022-11-22T01:15:34.13Z","modified":"2026-06-17T05:04:05.743Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-359"],"updated_at":"2026-11-02T14:07:32.395456Z"}],"osv":[{"id":"CVE-2022-41936","title":"Exposure of Private Personal Information to an Unauthorized Actor in xwiki-platform-rest-server","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The `modifications` rest endpoint does not filter out entries according to the user's rights. Therefore, information hidden from unauthorized users are exposed though the `modifications` rest endpoint (comments and page names etc). Users should upgrade to XWiki 14.6+, 14.4.3+, or 13.10.8+. Older versions have not been patched. There are no known workarounds.","status":"published","published":"2022-11-22T00:00:00Z","modified":"2026-10-28T10:31:28.122971317Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-359"],"updated_at":"2026-11-02T15:44:27.186787Z"},{"id":"GHSA-p88w-fhxw-xvcc","title":"Exposure of Private Personal Information to an Unauthorized Actor in org.xwiki.platform:xwiki-platform-rest-server","description":"### Impact\nThe `modifications` rest endpoint does not filter out entries according to the user's rights. Therefore, information hidden from unauthorized users are exposed though the `modifications` rest endpoint (e.g., comments, page names...). \n\n### Patches\nUsers should upgrade to XWiki 14.6+, 14.4.3+,  or13.10.8+. Older versions have not been patched.\n\n### Workarounds\nNo known workaround.\n\n### References\n\n- Patch: https://github.com/xwiki/xwiki-platform/commit/38dc1aa1a4435f24d58f5b8e4566cbcb0971f8ff\n- Jira issue: https://jira.xwiki.org/browse/XWIKI-19997\n\n### For more information\nIf you have any questions or comments about this advisory:\n\n- Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)\n- Email us at [Security Mailing List](mailto:security@xwiki.org)\n","status":"published","published":"2022-11-21T23:25:00Z","modified":"2023-11-08T04:10:36.487267Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-359"],"updated_at":"2026-11-02T15:46:52.891208Z"}]}}