GitHub Advisoryadvisory · Maven

GHSA-8959-rfxh-r4j4 XWiki vulnerable to Denial of Service attack through attachments

HIGH Published 2024-01-08 Modified 2024-01-09 Official page ↗
Aliases
CVE-2024-21651
Ecosystem
Maven
Packages
org.xwiki.platform:xwiki-platform-distribution-war
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400
Reviewed
2024-01-08

Affected packages

• Maven org.xwiki.platform:xwiki-platform-distribution-war: >= 14.10, < 14.10.18 → fixed in 14.10.18 • Maven org.xwiki.platform:xwiki-platform-distribution-war: >= 15.0-rc-1, < 15.5.3 → fixed in 15.5.3 • Maven org.xwiki.platform:xwiki-platform-distribution-war: >= 15.6-rc-1, < 15.8-rc-1 → fixed in 15.8-rc-1

Description

Impact A user able to attach a file to a page can post a malformed TAR file by manipulating file modification times headers, which when parsed by Tika, could cause a denial of service issue via CPU consumption. Patches This vulnerability has been patched in XWiki 14.10.18, 15.5.3 and 15.8 RC1. Workarounds The workaround is to download commons-compress 1.24 and replace the one located in XWiki `WEB-INF/lib/` folder. References https://jira.xwiki.org/browse/XCOMMONS-2796 For more information If you have any questions or comments about this advisory: • Open an issue in Jira XWiki.org • Email us at Security Mailing List

Related

Alias · CVE (1)

  • CVE-2024-21651 XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References