| Package | Affected versions | Patched versions |
|---|---|---|
| org.xwiki.platform:xwiki-platform-skin-skinx | ≥ 4.2-milestone-2, < 16.10.7 | 16.10.7 |
| xwiki | = 4.2≥ 17.0.0, ≤ 17.3.0≥ 4.3, < 16.10.7 | 16.10.7 |
It's possible to get access and read configuration files by using URLs such as http://localhost:8080/bin/ssx/Main/WebHome?resource=../../WEB-INF/xwiki.cfg&minify=false.
This can apparently be reproduced on Tomcat instances.
This has been patched in 17.4.0-rc-1, 16.10.7.
There is no known workaround, other than upgrading XWiki.
If you have any questions or comments about this advisory:
The vulnerability was reported by Gregor Neumann.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free