Vulnerability · Published Apr 8, 2022 · Assigned by GitHub_M
CVE-2022-24819Unauthenticated user can retrieve the list of users through uorgsuggest.vm
Medium 5.3
In plain English
A medium-severity security flaw in xwiki-platform from xwiki. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 3.2% (higher than 88% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei. Fixed versions are available - upgrade the affected package.
Official description
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A guest user without the right to view pages of the wiki can still list documents related to users of the wiki. The problem has been patched in XWiki versions 12.10.11, 13.4.4, and 13.9-rc-1. There is no known workaround for this problem.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.xwiki.platform:xwiki-platform-web-templates | 12.10.11 | GHSA-97jg-43c9-q6pf |
| Maven | org.xwiki.platform:xwiki-platform-web-templates | 13.4.4 | GHSA-97jg-43c9-q6pf |
| Maven | org.xwiki.platform:xwiki-platform-web-templates | 13.9 | GHSA-97jg-43c9-q6pf |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| xwiki | xwiki-platform | < 4.3 |
Weakness: CWE-359 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-97jg-43c9-q6pf x_refsource_CONFIRM
- https://jira.xwiki.org/browse/XWIKI-18850 x_refsource_MISC