| Package | Affected versions | Patched versions |
|---|---|---|
| org.xwiki.platform:xwiki-platform-rest-server | ≥ 15.10.6, < 16.10.17≥ 17.0.0-rc-1, < 17.4.9≥ 17.5.0, < 17.10.3≥ 18.0.0-rc-1, < 18.1.0-rc-1 | 16.10.1717.4.917.10.318.1.0-rc-1 |
POST /wikis/{wikiName} executes a XAR import without performing any authentication or authorization checks, allowing an unauthenticated attacker to create or update documents in the target wiki
This vulnerability has been patched in XWiki 16.10.17, 17.4.9, 17.10.3, 18.0.1 and 18.1.0-rc-1.
XWiki is not aware of any workarounds other than adding a rule into an HTTP proxy to prevent access POST request in the /wikis/{wikiName}[/] endpoint.
If there are any questions or comments about this advisory:
Reported by Sho Odagiri (GMO Cybersecurity by Ierae, Inc.).
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free