CVE-2022-23618: URL Redirection to Untrusted Site in org.xwiki.platform:xwiki-platform-oldcore
Summary
CVE-2022-23618: URL Redirection to Untrusted Site ('Open Redirect'). Affects org.xwiki.platform:xwiki-platform-oldcore across 2 version ranges.
< 12.10.7
>= 13.0.0, < 13.3RC1
Fixed in 12.10.7 or 13.3RC1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
org.xwiki.platform:xwiki-platform-oldcore is a Maven package that provides core functionality for the XWiki platform. XWiki is an open-source wiki software that allows users to create and collaborate on content. The package is widely used in various applications and websites that utilize the XWiki platform. However, it is vulnerable to URL redirection to untrusted sites, which can lead to potential security risks.
Vulnerability Detail
The vulnerability in org.xwiki.platform:xwiki-platform-oldcore allows for URL redirection to untrusted sites. This means that an attacker can craft a malicious URL that redirects users to a different website, potentially a phishing or malware-infected site. The vulnerability arises from a lack of protection against such redirections, particularly through well-known parameters like 'xredirect'. This can be exploited by an attacker to deceive users and trick them into visiting malicious sites.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 12.10.712.10.7 -
>= 13.0.0, < 13.3RC113.3RC1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is necessary to apply the provided patches or update to the fixed versions of XWiki to ensure the security of the application.
Conclusion
The vulnerability in org.xwiki.platform:xwiki-platform-oldcore allows for URL redirection to untrusted sites, posing potential security risks to applications and websites utilizing the XWiki platform. To mitigate this vulnerability, it is crucial to update to the patched versions of XWiki (12.10.7 or 13.3RC1). No known workarounds exist for this issue. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.xwiki.platform:xwiki-platform-oldcore →
FAQ
The vulnerability allows for URL redirection to untrusted sites, which can lead to users being redirected to malicious websites. This can result in various security risks, such as phishing attacks or the installation of malware on the user's system.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using only the pom.xml file.
No, there are no known workarounds for this vulnerability. It is necessary to apply the provided patches or update to the fixed versions of XWiki.
Versions of XWiki up to 12.10.7 are affected by this vulnerability. Additionally, versions from 13.0.0 up to 13.2 are also vulnerable. It is recommended to update to XWiki 12.10.7 or XWiki 13.3RC1 to address the issue.
You can find more information about this vulnerability in the XWiki JIRA issue XWIKI-10309 (https://jira.xwiki.org/browse/XWIKI-10309). Additionally, you can reach out to the XWiki security team by emailing security@xwiki.org.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.xwiki.platform:xwiki-platform-oldcore.
