Vulnerability · Published Feb 9, 2022 · Assigned by GitHub_M
CVE-2022-23618Open Redirect in xwiki-platform
Medium 4.7
In plain English
A medium-severity open redirect in xwiki-platform from xwiki. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions there is no protection against URL redirection to untrusted sites, in particular some well known parameters (xredirect) can be used to perform url redirections. This problem has been patched in XWiki 12.10.7 and XWiki 13.3RC1. Users are advised to update. There are no known workarounds for this issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.xwiki.platform:xwiki-platform-oldcore | 12.10.7 | GHSA-jp55-vvmf-63mv |
| Maven | org.xwiki.platform:xwiki-platform-oldcore | 13.3RC1 | GHSA-jp55-vvmf-63mv |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| xwiki | xwiki-platform | >= 13.0.0, < 13.3RC1< 12.10.7 |
Weakness: CWE-601 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
References
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-jp55-vvmf-63mv x_refsource_CONFIRM
- https://github.com/xwiki/xwiki-platform/commit/5251c02080466bf9fb55288f04a37671108f8096 x_refsource_MISC
- https://jira.xwiki.org/browse/XWIKI-10309 x_refsource_MISC