title: Missing Authorization in User#setDisabledStatus in org.xwiki.platform:xwiki-platform-oldcore
description: org.xwiki.platform:xwiki-platform-oldcore is missing authorization in User#setDisabledStatus, which may allow an incorrectly authorized user with only Script rights to enable or disable a user. This operation is meant to only be available for users with admin rights. This problem has been patched in XWiki 13.10.7, 14.4.2 and 14.5RC1.
problem types: CWE-862: Missing Authorization
affected:
{
vendor: xwiki
product: xwiki-platform
versions:
version: >= 11.7RC1, < 13.10.7, status: affected
version: >= 14.0.0, < 14.4.2, status: affected
}
metrics:
cvssV3_1: [
version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: NONE
baseScore: 4.9
baseSeverity: MEDIUM
]