GHSA-7f2f-pcv3-j2r7

    Dashboard / Vulnerabilities / GHSA-7f2f-pcv3-j2r7

    GHSA-7f2f-pcv3-j2r7

    Published: 20 Jun 2023Last Modified: 10 Sept 2026

    Summary: XWiki Platform's tags on non-viewable pages can be revealed to users

    Details: ### Impact Tags from pages not viewable to the current user are leaked by the tags API. This information can also be exploited to infer the document reference of non-viewable pages. ### Patches This vulnerability has been patched in XWiki 14.4.8, 14.10.4, and 15.0 RC1. ### Workarounds There is no workaround apart from upgrading to a fixed version. ### References - https://jira.xwiki.org/browse/XWIKI-20002 ### For more information If you have any questions or comments about this advisory: * Open an issue in [Jira XWiki.org](https://jira.xwiki.org/) * Email us at [Security Mailing List](mailto:[email protected])

    References: https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-7f2f-pcv3-j2r7, https://nvd.nist.gov/vuln/detail/CVE-2023-34466, https://github.com/xwiki/xwiki-platform, https://jira.xwiki.org/browse/XWIKI-20002

    Affected packages

    Package

    Name: org.xwiki.platform:xwiki-platform-tag-api

    Purl: pkg:maven/org.xwiki.platform/xwiki-platform-tag-api

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 5.0-milestone-1
    Fixed -14.4.8

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-7f2f-pcv3-j2r7 | CVE-DB