GitHub Advisoryadvisory · Maven
GHSA-jp55-vvmf-63mv URL Redirection to Untrusted Site ('Open Redirect')
MEDIUM
Official page ↗
- Aliases
- CVE-2022-23618
- Ecosystem
- Maven
- Packages
- org.xwiki.platform:xwiki-platform-oldcore
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
- Weaknesses
- CWE-601
- Reviewed
- 2022-02-09
Affected packages
• Maven org.xwiki.platform:xwiki-platform-oldcore: < 12.10.7 → fixed in 12.10.7
• Maven org.xwiki.platform:xwiki-platform-oldcore: >= 13.0.0, < 13.3RC1 → fixed in 13.3RC1
Description
Impact
There's no protection against URL redirection to untrusted site, in particular some well known parameters (xredirect) can be used to perform such redirections.
Patches
The problem has been patched in XWiki 12.10.7 and XWiki 13.3RC1.
Workarounds
There's no known workaround for this issue.
References
https://jira.xwiki.org/browse/XWIKI-10309
For more information
If you have any questions or comments about this advisory:
• Open an issue in JIRA
• Email us at Security ML
Related
Alias · CVE (1)
- CVE-2022-23618 XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. vulnerability
Weakness · CWE (1)
- CWE-601 URL Redirection to Untrusted Site weakness
References
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-jp55-vvmf-63mv web
- https://nvd.nist.gov/vuln/detail/CVE-2022-23618 advisory
- https://github.com/xwiki/xwiki-platform/commit/5251c02080466bf9fb55288f04a37671108f8096 web
- https://github.com/xwiki/xwiki-platform package
- https://jira.xwiki.org/browse/XWIKI-10309 web