GHSA-qpp2-2mcp-2wm5

Suggest an improvement
Source
https://github.com/advisories/GHSA-qpp2-2mcp-2wm5
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/04/GHSA-qpp2-2mcp-2wm5/GHSA-qpp2-2mcp-2wm5.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-qpp2-2mcp-2wm5
Aliases
Published
2022-04-08T22:00:54Z
Modified
2023-11-01T04:58:09.949090Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
Unauthenticated user can list hidden document from multiple velocity templates in XWiki
Details

Impact

A guest user without the right to view pages of the wiki can still list documents by rendering some velocity documents.

Patches

The problem has been patched in XWiki versions 12.10.11, 13.4.4, and 13.9-rc-1.

Workarounds

There is no known workaround for this problem.

References

https://jira.xwiki.org/browse/XWIKI-16544

For more information

If you have any questions or comments about this advisory: * Open an issue in Jira XWiki * Email us at our security mailing list

Database specific
{
    "nvd_published_at": "2022-04-08T20:15:00Z",
    "cwe_ids": [
        "CWE-200",
        "CWE-306",
        "CWE-359"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2022-04-08T22:00:54Z"
}
References

Affected packages

Maven / org.xwiki.platform:xwiki-platform-web

Package

Name
org.xwiki.platform:xwiki-platform-web
View open source insights on deps.dev
Purl
pkg:maven/org.xwiki.platform/xwiki-platform-web

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
12.10.11

Maven / org.xwiki.platform:xwiki-platform-web

Package

Name
org.xwiki.platform:xwiki-platform-web
View open source insights on deps.dev
Purl
pkg:maven/org.xwiki.platform/xwiki-platform-web

Affected ranges

Type
ECOSYSTEM
Events
Introduced
13.0.0
Fixed
13.4.4

Maven / org.xwiki.platform:xwiki-platform-web

Package

Name
org.xwiki.platform:xwiki-platform-web
View open source insights on deps.dev
Purl
pkg:maven/org.xwiki.platform/xwiki-platform-web

Affected ranges

Type
ECOSYSTEM
Events
Introduced
13.5.0
Fixed
13.9