GHSA-vvp7-r422-rx83

Suggest an improvement
Source
https://github.com/advisories/GHSA-vvp7-r422-rx83
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/04/GHSA-vvp7-r422-rx83/GHSA-vvp7-r422-rx83.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-vvp7-r422-rx83
Aliases
Published
2023-04-12T20:40:00Z
Modified
2023-11-01T05:01:47.921737Z
Severity
  • 3.7 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
Unauthenticated user can have information about hidden users on subwikis through uorgsuggest.vm
Details

Impact

It's possible to list some users who are normally not viewable from subwiki by requesting users on a subwiki which allows only global users with uorgsuggest.vm. This issue only concerns hidden users from main wiki. Note that the disclosed information are the username and the first and last name of users, no other information is leaked.

Patches

The problem has been patched on XWiki 13.10.8, 14.4.3 and 14.7RC1.

Workarounds

It's possible to workaround this vulnerability by patching directly uorgsuggest.vm to apply the same changes as in https://github.com/xwiki/xwiki-platform/pull/1883.

References

  • JIRA ticket: https://jira.xwiki.org/browse/XWIKI-20007
  • this vulnerability is actually a remaining of https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-97jg-43c9-q6pf which wasn't entirely fixed back then

For more information

If you have any questions or comments about this advisory: * Open an issue in Jira * Email us at security ML

Database specific
{
    "nvd_published_at": "2023-04-15T16:15:00Z",
    "github_reviewed_at": "2023-04-12T20:40:00Z",
    "severity": "LOW",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-359",
        "CWE-668"
    ]
}
References

Affected packages

Maven / org.xwiki.platform:xwiki-platform-web-templates

Package

Name
org.xwiki.platform:xwiki-platform-web-templates
View open source insights on deps.dev
Purl
pkg:maven/org.xwiki.platform/xwiki-platform-web-templates

Affected ranges

Type
ECOSYSTEM
Events
Introduced
13.9-rc-1
Fixed
13.10.8

Maven / org.xwiki.platform:xwiki-platform-web-templates

Package

Name
org.xwiki.platform:xwiki-platform-web-templates
View open source insights on deps.dev
Purl
pkg:maven/org.xwiki.platform/xwiki-platform-web-templates

Affected ranges

Type
ECOSYSTEM
Events
Introduced
14.0-rc-1
Fixed
14.4.3

Maven / org.xwiki.platform:xwiki-platform-web-templates

Package

Name
org.xwiki.platform:xwiki-platform-web-templates
View open source insights on deps.dev
Purl
pkg:maven/org.xwiki.platform/xwiki-platform-web-templates

Affected ranges

Type
ECOSYSTEM
Events
Introduced
14.5
Fixed
14.7-rc-1