CVE-2022-24820: Unauthenticated User Can List Hidden Documents in XWiki
Summary
CVE-2022-24820: Unauthenticated user can list hidden document from multiple velocity templates in XWiki. Affects org.xwiki.platform:xwiki-platform-web across 3 version ranges.
< 12.10.11
>= 13.0.0, < 13.4.4
>= 13.5.0, < 13.9
Fixed in 12.10.11, 13.4.4 or 13.9, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
XWiki is an open-source wiki software platform that allows users to create and manage collaborative websites. It provides features such as document management, version control, access control, and extensibility through plugins. The XWiki platform is written in Java and is commonly used for knowledge management, documentation, and collaboration purposes. However, a vulnerability has been discovered in XWiki that allows an unauthenticated guest user to list hidden documents by rendering certain velocity templates.
Vulnerability Detail
The vulnerability in XWiki allows a guest user without the necessary permissions to view pages to still list documents by rendering specific velocity templates. This means that even though the user does not have the rights to access certain pages in the wiki, they can still obtain a list of those hidden documents. This can potentially expose sensitive information that should not be accessible to unauthorized users. The vulnerability has a CVSS score of 5.3, indicating a moderate severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 12.10.1112.10.11 -
>= 13.0.0, < 13.4.413.4.4 -
>= 13.5.0, < 13.913.9
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is necessary to apply the provided patches or update to the patched versions of XWiki to address the issue.
Conclusion
In conclusion, the vulnerability in XWiki allows unauthenticated users to list hidden documents, potentially exposing sensitive information. To mitigate this vulnerability, it is crucial to update XWiki to the patched versions or apply the provided patches. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for org.xwiki.platform:xwiki-platform-web →
FAQ
The impact of this vulnerability is that an unauthenticated guest user can list hidden documents in XWiki, potentially accessing sensitive information that should not be visible to them.
Any XWiki installation using versions prior to 12.10.11, 13.4.4, or 13.9-rc-1 is affected by this vulnerability.
No, there are no known workarounds for this vulnerability. Updating to the patched versions of XWiki is the recommended solution.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your XWiki installation is affected by this vulnerability. Simply enter your pom.xml file and the playground will analyze it for vulnerabilities.
You can find more information about this vulnerability in the XWiki Jira (https://jira.xwiki.org/browse/XWIKI-16544) and the GitHub Advisory Database (https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/04/GHSA-qpp2-2mcp-2wm5/GHSA-qpp2-2mcp-2wm5.json).
Related vulnerabilities
Recent vulnerabilities recorded for org.xwiki.platform:xwiki-platform-web.
