Описание
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 5.0-milestone-1 and prior to versions 14.4.8, 14.10.4, and 15.0-rc-1, tags from pages not viewable to the current user are leaked by the tags API. This information can also be exploited to infer the document reference of non-viewable pages. This vulnerability has been patched in XWiki 14.4.8, 14.10.4, and 15.0-rc-1.
Ссылки
- Vendor Advisory
- ExploitIssue TrackingPatchVendor Advisory
- Vendor Advisory
- ExploitIssue TrackingPatchVendor Advisory
Уязвимые конфигурации
Конфигурация 1Версия от 5.0.1 (включая) до 14.4.8 (исключая)Версия от 14.10 (включая) до 14.10.4 (исключая)
Одно из
cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*
cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*
cpe:2.3:a:xwiki:xwiki:5.0:milestone1:*:*:*:*:*:*
EPSS
Процентиль: 41%
0.0019
Низкий
4.3 Medium
CVSS3
Дефекты
CWE-200
Связанные уязвимости
CVSS3: 4.3
github
больше 2 лет назад
XWiki Platform's tags on non-viewable pages can be revealed to users
EPSS
Процентиль: 41%
0.0019
Низкий
4.3 Medium
CVSS3
Дефекты
CWE-200