| Package | Affected versions | Patched versions |
|---|---|---|
| org.xwiki.platform:xwiki-platform-oldcore | ≥ 8.3-rc-1, < 13.10.3 | 13.10.3 |
| xwiki | = 8.3≥ 8.4, < 13.10.3 | 13.10.3 |
One can ask for any file located in the classloader using the template API and a path with ".." in it. For example
{{template name="../xwiki.hbm.xml"/}}
To our knownledge none of the available files of the classloader in XWiki Standard contain any strong confidential data, hence the low confidentiality value of this advisory.
The issue is patched in versions 14.0 and 13.10.3.
There's no easy workaround for this issue, administrators should upgrade their wiki.
If you have any questions or comments about this advisory:
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free