Vulnerability · Published Nov 22, 2022 · Assigned by GitHub_M
CVE-2022-41936Exposure of Private Personal Information to an Unauthorized Actor in xwiki-platform-rest-server
Medium 5.3
In plain English
A medium-severity security flaw in xwiki-platform from xwiki. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The `modifications` rest endpoint does not filter out entries according to the user's rights. Therefore, information hidden from unauthorized users are exposed though the `modifications` rest endpoint (comments and page names etc). Users should upgrade to XWiki 14.6+, 14.4.3+, or 13.10.8+. Older versions have not been patched. There are no known workarounds.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.xwiki.platform:xwiki-platform-rest-server | 13.10.8 | GHSA-p88w-fhxw-xvcc |
| Maven | org.xwiki.platform:xwiki-platform-rest-server | 14.4.3 | GHSA-p88w-fhxw-xvcc |
| Maven | org.xwiki.platform:xwiki-platform-rest-server | 14.6 | GHSA-p88w-fhxw-xvcc |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| xwiki | xwiki-platform | >= 8.1, < 13.10.8>= 14.0.0, < 14.4.3>= 14.5.0, < 14.6 |
Weakness: CWE-359 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N