| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|---|---|
| org.xwiki.platform:xwiki-platform-rest-server | ≥ 1.8.1, < 14.10.22≥ 15.0-rc-1, < 15.10.12≥ 16.0.0-rc-1, < 16.4.3≥ 16.5.0-rc-1, < 16.7.0 | 14.10.2215.10.1216.4.316.7.0 |
| xwiki | ≥ 1.8.1, < 14.10.22≥ 15.0, < 15.10.12≥ 16.0.0, < 16.4.3≥ 16.5.0, < 16.7.0 | 14.10.2215.10.1216.4.316.7.0 |
Anyone can access the metadata of any attachment in the wiki using the wiki attachment REST endpoint. It's not filtering the result depending on current user rights, a not authenticated user could exploit this even in a totally private wiki.
To reproduce:
You get a list of attachments, while the expected result should be an empty list.
This vulnerability has been fixed in XWiki 14.10.22, 15.10.12, 16.7.0-rc-1 and 16.4.3.
We're not aware of any workaround except upgrading.
If you have any questions or comments about this advisory:
Issue reported by Lukas Monert.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí