GHSA-97jg-43c9-q6pf

Source

https://github.com/advisories/GHSA-97jg-43c9-q6pf

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/04/GHSA-97jg-43c9-q6pf/GHSA-97jg-43c9-q6pf.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-97jg-43c9-q6pf

Aliases

CVE-2022-24819

Published

2022-04-08T21:53:38Z

Modified

2023-11-08T04:08:37.572170Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator

Summary

Unauthenticated user can retrieve the list of users through uorgsuggest.vm

Details

A guest user without the right to view pages of the wiki can still list documents related to users of the wiki. The problem has been patched in XWiki versions 12.10.11, 13.4.4, and 13.9-rc-1. There is no known workaround for this problem.

Database specific

{
    "nvd_published_at": "2022-04-08T20:15:00Z",
    "github_reviewed_at": "2022-04-08T21:53:38Z",
    "severity": "MODERATE",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-359"
    ]
}

References

Affected packages

Maven / org.xwiki.platform:xwiki-platform-web-templates

Package

Name: org.xwiki.platform:xwiki-platform-web-templates; View open source insights on deps.dev
Purl: pkg:maven/org.xwiki.platform/xwiki-platform-web-templates

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

12.10.11

Maven / org.xwiki.platform:xwiki-platform-web-templates

Package

Name: org.xwiki.platform:xwiki-platform-web-templates; View open source insights on deps.dev
Purl: pkg:maven/org.xwiki.platform/xwiki-platform-web-templates

Affected ranges

Type: ECOSYSTEM
Events: Introduced

13.0.0

Fixed

13.4.4

Maven / org.xwiki.platform:xwiki-platform-web-templates

Package

Name: org.xwiki.platform:xwiki-platform-web-templates; View open source insights on deps.dev
Purl: pkg:maven/org.xwiki.platform/xwiki-platform-web-templates

Affected ranges

Type: ECOSYSTEM
Events: Introduced

13.5.0

Fixed

13.9