| Package | Affected versions | Patched versions |
|---|---|---|
| org.xwiki.platform:xwiki-platform-store-filesystem-oldcore | ≥ 14.3-rc-1, < 14.4.6≥ 14.5, < 14.9-rc-1 | 14.4.614.9-rc-1 |
| xwiki | ≥ 14.3, < 14.4.6≥ 14.5, < 14.9 | 14.4.614.9 |
org.xwiki.store.script.TemporaryAttachmentsScriptService#uploadTemporaryAttachment is returning an instance of com.xpn.xwiki.doc.XWikiAttachment. This class is not supported to be exposed to users without the programing right.
com.xpn.xwiki.api.Attachment should be used instead and takes case of checking the user's rights before performing dangerous operations.
This has been patched in the version 14.9-rc-1 and 14.4.6.
There's no workaround for this issue.
https://jira.xwiki.org/browse/XWIKI-20180
If you have any questions or comments about this advisory:
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free