Vulnerability · Published Apr 8, 2022 · Assigned by GitHub_M

CVE-2022-24820Unauthenticated user can list hidden document from multiple velocity templates

Medium 5.3

In plain English

A medium-severity security flaw in xwiki-platform from xwiki. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 63% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)1.0%top 37.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A guest user without the right to view pages of the wiki can still list documents by rendering some velocity documents. The problem has been patched in XWiki versions 12.10.11, 13.4.4, and 13.9-rc-1. There is no known workaround for this problem.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	org.xwiki.platform:xwiki-platform-web	12.10.11	GHSA-qpp2-2mcp-2wm5
Maven	org.xwiki.platform:xwiki-platform-web	13.4.4	GHSA-qpp2-2mcp-2wm5
Maven	org.xwiki.platform:xwiki-platform-web	13.9	GHSA-qpp2-2mcp-2wm5

Affected products (as reported)

Vendor	Product	Versions
xwiki	xwiki-platform	< 8.4.5, < 10.11.8, < 11.3.1, < 13.6-rc-1

Weakness: CWE-359 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-qpp2-2mcp-2wm5 x_refsource_CONFIRM
https://jira.xwiki.org/browse/XWIKI-16544 x_refsource_MISC