XWiki missing authorization when accessing the wiki level attachments list and metadata via REST API
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 14.10.22, 15.10.12, 16.4.3, 16.7.0
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- 1 Nuclei template
- Exploitation: poc
- Automatable: yes
- Technical impact: partial
Summary
XWiki is a generic wiki platform. In versions starting from 1.8.1 to before 14.10.22, from 15.0-rc-1 to before 15.10.12, from 16.0.0-rc-1 to before 16.4.3, and from 16.5.0-rc-1 to before 16.7.0, anyone can access the metadata of any attachment in the wiki using the wiki attachment REST endpoint. There is no filtering for the results depending on current user rights, meaning an unauthenticated user could exploit this even in a private wiki. This issue has been patched in versions 14.10.22, 15.10.12, 16.4.3, and 16.7.0.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: poc · Automatable: yes · Technical impact: partial
- Record last updated
Affected versions
- xwiki xwiki-platform
From 1.8.1 · fixed in 14.10.22; From 15.0-rc-1 · fixed in 15.10.12; From 16.0.0-rc-1 · fixed in 16.4.3; From 16.5.0-rc-1 · fixed in 16.7.0
- org.xwiki.platform:xwiki-platform-rest-serverMaven
From 1.8.1 · fixed in 14.10.22
- org.xwiki.platform:xwiki-platform-rest-serverMaven
From 15.0-rc-1 · fixed in 15.10.12
- org.xwiki.platform:xwiki-platform-rest-serverMaven
From 16.0.0-rc-1 · fixed in 16.4.3
- org.xwiki.platform:xwiki-platform-rest-serverMaven
From 16.5.0-rc-1 · fixed in 16.7.0