| Package | Affected versions | Patched versions |
|---|---|---|
| org.xwiki.platform:xwiki-platform-tag-api | ≥ 14.5, < 14.10.4≥ 5.0-milestone-1, < 14.4.8 | 14.10.414.4.8 |
| xwiki | = 5.0≥ 14.10, < 14.10.4≥ 5.0.1, < 14.4.8 | 14.10.414.4.8 |
Tags from pages not viewable to the current user are leaked by the tags API. This information can also be exploited to infer the document reference of non-viewable pages.
This vulnerability has been patched in XWiki 14.4.8, 14.10.4, and 15.0 RC1.
There is no workaround apart from upgrading to a fixed version.
If you have any questions or comments about this advisory:
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free