Any user with SCRIPT right (EDIT right before XWiki 7.4) can read any file located in the XWiki WAR (for example xwiki.cfg and xwiki.properties) through XWiki#invokeServletAndReturnAsString:
$xwiki.invokeServletAndReturnAsString("/WEB-INF/xwiki.cfg")
It has been patched in XWiki versions 12.10.9, 13.4.3 and 13.7-rc-1.
The only workaround is to give SCRIPT right only to trusted users.
https://jira.xwiki.org/browse/XWIKI-18870
If you have any questions or comments about this advisory: * Open an issue in Jira XWiki * Email us at our security mailing list
{ "nvd_published_at": "2022-02-09T22:15:00Z", "cwe_ids": [ "CWE-552", "CWE-862" ], "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2022-02-09T21:56:05Z" }