| Package | Affected versions | Patched versions |
|---|---|---|
| org.xwiki.platform:xwiki-platform-rest-server | ≥ 1.8.1, < 14.10.22≥ 15.0-rc-1, < 15.10.12≥ 16.0.0-rc-1, < 16.4.3≥ 16.5.0-rc-1, < 16.7.0 | 14.10.2215.10.1216.4.316.7.0 |
| xwiki | ≥ 1.8.1, < 14.10.22≥ 15.0, < 15.10.12≥ 16.0.0, < 16.4.3≥ 16.5.0, < 16.7.0 | 14.10.2215.10.1216.4.316.7.0 |
Anyone can access the metadata of any attachment in the wiki using the wiki attachment REST endpoint. It's not filtering the result depending on current user rights, a not authenticated user could exploit this even in a totally private wiki.
To reproduce:
You get a list of attachments, while the expected result should be an empty list.
This vulnerability has been fixed in XWiki 14.10.22, 15.10.12, 16.7.0-rc-1 and 16.4.3.
We're not aware of any workaround except upgrading.
If you have any questions or comments about this advisory:
Issue reported by Lukas Monert.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free