Log in Start free

Vulnerability · Published Oct 25, 2023 · Assigned by GitHub_M

CVE-2023-37910org.xwiki.platform:xwiki-platform-attachment-api vulnerable to Missing Authorization on Attachment Move

High 8.1

In plain English

A high-severity missing authorization in xwiki-platform from xwiki. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.1High
Exploit odds (30 days)0.7%top 45.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting with the introduction of attachment move support in version 14.0-rc-1 and prior to versions 14.4.8, 14.10.4, and 15.0-rc-1, an attacker with edit access on any document (can be the user profile which is editable by default) can move any attachment of any other document to this attacker-controlled document. This allows the attacker to access and possibly publish any attachment of which the name is known, regardless if the attacker has view or edit rights on the source document of this attachment. Further, the attachment is deleted from the source document. This vulnerability has been patched in XWiki 14.4.8, 14.10.4, and 15.0 RC1. There is no workaround apart from upgrading to a fixed version.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavenorg.xwiki.platform:xwiki-platform-attachment-api14.4.8GHSA-rwwx-6572-mp29
Mavenorg.xwiki.platform:xwiki-platform-attachment-api14.10.4GHSA-rwwx-6572-mp29

Affected products (as reported)

VendorProductVersions
xwiki xwiki-platform >= 14.0-rc-1, < 14.4.8>= 14.5, < 14.10.4

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References