CVE-2022-29253: Path Traversal in XWiki Platform
Summary
CVE-2022-29253: Path Traversal in XWiki Platform. Affects org.xwiki.platform:xwiki-platform-oldcore versions >= 8.3-rc-1, < 13.10.3. Fixed in 13.10.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
XWiki Platform is an open-source wiki software that allows users to create and collaborate on content. It provides a flexible and extensible framework for building web applications. The vulnerability in XWiki Platform allows an attacker to request any file located in the classloader using the template API and a path with ".." in it. This can lead to unauthorized access to sensitive files and potential information disclosure.
Vulnerability Detail
The path traversal vulnerability in XWiki Platform arises from improper input validation. By including ".." in the path, an attacker can bypass the intended file access restrictions and retrieve files outside the intended directory. Although the available files in the classloader of XWiki Standard do not contain strong confidential data, the vulnerability still poses a risk of unauthorized access to sensitive information. The severity of this vulnerability is rated as LOW.
How To Fix
Minimum fixed version
13.10.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no easy workaround for this issue. The recommended solution is to upgrade the XWiki installation to a patched version.
Conclusion
The path traversal vulnerability in XWiki Platform can be mitigated by upgrading to the patched versions. It is important to keep software up to date to ensure the security of the system. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for org.xwiki.platform:xwiki-platform-oldcore →
FAQ
XWiki Platform is an open-source wiki software that allows users to create and collaborate on content. It provides a flexible and extensible framework for building web applications.
The vulnerability allows an attacker to request files outside the intended directory, potentially leading to unauthorized access to sensitive information.
To our knowledge, none of the available files in the classloader of XWiki Standard contain strong confidential data.
To fix the vulnerability, administrators should upgrade their XWiki installation to one of the patched versions (14.0 or 13.10.3).
There is no easy workaround for this issue. The recommended solution is to upgrade the XWiki installation to a patched version.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.xwiki.platform:xwiki-platform-oldcore.
