| Package | Affected versions | Patched versions |
|---|---|---|
| org.xwiki.platform:xwiki-platform-webjars | ≥ 6.1-miletone-2, ≤ 7.1.3 | |
| org.xwiki.platform:xwiki-platform-webjars-api | ≥ 17.0.0-rc-1, < 17.4.0-rc-1≥ 7.1.4, < 16.10.7 | 17.4.0-rc-116.10.7 |
| xwiki | = 6.1≥ 17.0.0, ≤ 17.3.0≥ 6.2, < 16.10.7 | 16.10.7 |
It's possible to get access and read configuration files by using URLs such as http://localhost:8080/xwiki/webjars/wiki%3Axwiki/..%2F..%2F..%2F..%2F..%2FWEB-INF%2Fxwiki.cfg. The trick here is to encode the / which is decoded when parsing the URL segment, but not re-encoded when assembling the file path.
This has been patched in 17.4.0-rc-1, 16.10.7.
There is no known workaround, other than upgrading XWiki.
If you have any questions or comments about this advisory:
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free