GitHub Advisoryadvisory · Maven

GHSA-7f2f-pcv3-j2r7 XWiki Platform's tags on non-viewable pages can be revealed to users

MEDIUM Published 2023-06-20 Modified 2023-06-20 Official page ↗
Aliases
CVE-2023-34466
Ecosystem
Maven
Packages
org.xwiki.platform:xwiki-platform-tag-api
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-200
Reviewed
2023-06-20

Affected packages

• Maven org.xwiki.platform:xwiki-platform-tag-api: >= 5.0-milestone-1, < 14.4.8 → fixed in 14.4.8 • Maven org.xwiki.platform:xwiki-platform-tag-api: >= 14.5, < 14.10.4 → fixed in 14.10.4

Description

Impact Tags from pages not viewable to the current user are leaked by the tags API. This information can also be exploited to infer the document reference of non-viewable pages. Patches This vulnerability has been patched in XWiki 14.4.8, 14.10.4, and 15.0 RC1. Workarounds There is no workaround apart from upgrading to a fixed version. References • https://jira.xwiki.org/browse/XWIKI-20002 For more information If you have any questions or comments about this advisory: • Open an issue in Jira XWiki.org • Email us at Security Mailing List

Related

Alias · CVE (1)

  • CVE-2023-34466 XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References