| Package | Affected versions | Patched versions |
|---|---|---|
| org.xwiki.platform:xwiki-platform-oldcore | ≥ 13.0, < 13.2-rc-1< 12.10.6 | 13.2-rc-112.10.6 |
| xwiki | = 13.0= 13.1≤ 12.10.5 |
Any user with edit right can copy the content of a page it does not have access to by using it as template of a new page.
It has been patched in XWiki 13.2CR1 and 12.10.6
There is no workaround beside patching.
https://jira.xwiki.org/browse/XWIKI-18430
If you have any questions or comments about this advisory:
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free