GHSA-7f2f-pcv3-j2r7

Source

https://github.com/advisories/GHSA-7f2f-pcv3-j2r7

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/06/GHSA-7f2f-pcv3-j2r7/GHSA-7f2f-pcv3-j2r7.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-7f2f-pcv3-j2r7

Aliases

CVE-2023-34466

Published

2023-06-20T16:45:12Z

Modified

2023-11-08T04:12:47.609139Z

Severity

4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator

Summary

XWiki Platform's tags on non-viewable pages can be revealed to users

Details

Impact

Tags from pages not viewable to the current user are leaked by the tags API. This information can also be exploited to infer the document reference of non-viewable pages.

Patches

This vulnerability has been patched in XWiki 14.4.8, 14.10.4, and 15.0 RC1.

Workarounds

There is no workaround apart from upgrading to a fixed version.

References

https://jira.xwiki.org/browse/XWIKI-20002

For more information

If you have any questions or comments about this advisory:

Open an issue in Jira XWiki.org
Email us at Security Mailing List

Database specific

{
    "nvd_published_at": "2023-06-23T16:15:09Z",
    "cwe_ids": [
        "CWE-200"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2023-06-20T16:45:12Z"
}

References

Affected packages

Maven / org.xwiki.platform:xwiki-platform-tag-api

Package

Name: org.xwiki.platform:xwiki-platform-tag-api; View open source insights on deps.dev
Purl: pkg:maven/org.xwiki.platform/xwiki-platform-tag-api

Affected ranges

Type: ECOSYSTEM
Events: Introduced

5.0-milestone-1

Fixed

14.4.8

Maven / org.xwiki.platform:xwiki-platform-tag-api

Package

Name: org.xwiki.platform:xwiki-platform-tag-api; View open source insights on deps.dev
Purl: pkg:maven/org.xwiki.platform/xwiki-platform-tag-api

Affected ranges

Type: ECOSYSTEM
Events: Introduced

14.5

Fixed

14.10.4