GHSA-qpp2-2mcp-2wm5

    Dashboard / Vulnerabilities / GHSA-qpp2-2mcp-2wm5

    GHSA-qpp2-2mcp-2wm5

    Published: 8 Apr 2022Last Modified: 8 Nov 2023

    Summary: Unauthenticated user can list hidden document from multiple velocity templates in XWiki

    Details: ### Impact A guest user without the right to view pages of the wiki can still list documents by rendering some velocity documents. ### Patches The problem has been patched in XWiki versions 12.10.11, 13.4.4, and 13.9-rc-1. ### Workarounds There is no known workaround for this problem. ### References https://jira.xwiki.org/browse/XWIKI-16544 ### For more information If you have any questions or comments about this advisory: * Open an issue in [Jira XWiki](https://jira.xwiki.org) * Email us at [our security mailing list](mailto:[email protected])

    References: https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-qpp2-2mcp-2wm5, https://nvd.nist.gov/vuln/detail/CVE-2022-24820, https://github.com/xwiki/xwiki-platform, https://jira.xwiki.org/browse/XWIKI-16544

    Affected packages

    Package

    Name: org.xwiki.platform:xwiki-platform-web

    Purl: pkg:maven/org.xwiki.platform/xwiki-platform-web

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -12.10.11

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-qpp2-2mcp-2wm5 | CVE-DB