org.xwiki.platform:xwiki-platform-oldcore vulnerable to data leak through deleted documents

高 7.5CVE-2023-29208 · GHSA-4f8g-fq6x-jqrr · 15/04/2023 公開 · 17/06/2026 更新

要点

CVE-2023-29208 は org.xwiki.platform:xwiki-platform-oldcore, xwiki (xwiki) に影響する深刻度「高」 (CVSS 7.5) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.93%（全脆弱性の 60.6% より高い）。
対処：13.10.11, 14.4.7, 14.10 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
org.xwiki.platform:xwiki-platform-oldcore Maven	`≥ 1.2-milestone-1, < 13.10.11≥ 14.0-rc-1, < 14.4.7≥ 14.5, < 14.10`	`13.10.1114.4.714.10`
xwiki xwiki	`≥ 1.1, < 13.10.11≥ 14.4.0, < 14.4.7≥ 14.5, < 14.10`	`13.10.1114.4.714.10`

概要

Impact

Rights added to a document are not taken into account for viewing it once it's deleted. Note that this vulnerability only impact deleted documents that where containing view rights: the view rights provided on a space of a deleted document are properly checked.

Patches

The problem has been patched in XWiki 14.10 by checking the rights of current user: only admin and deleter of the document are allowed to view it.

Workarounds

There is no workaround for this vulnerability other than upgrading.

References

Jira ticket: https://jira.xwiki.org/browse/XWIKI-16285
Commit: https://github.com/xwiki/xwiki-platform/commit/d9e947559077e947315bf700c5703dfc7dd8a8d7

For more information

If you have any questions or comments about this advisory:

Open an issue in Jira
Email us at security ML

NVD の説明

XWiki Commons are technical libraries common to several other top level XWiki projects. Rights added to a document are not taken into account for viewing it once it's deleted. Note that this vulnerability only impact deleted documents that where containing view rights: the view rights provided on a space of a deleted document are properly checked. The problem has been patched in XWiki 14.10 by checking the rights of current user: only admin and deleter of the document are allowed to view it.