GHSA-fp36-mjw5-fmgx

Source

https://github.com/advisories/GHSA-fp36-mjw5-fmgx

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/04/GHSA-fp36-mjw5-fmgx/GHSA-fp36-mjw5-fmgx.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-fp36-mjw5-fmgx

Aliases

CVE-2023-29513

Related

CVE-2023-29513

Published

2023-04-20T21:39:56Z

Modified

2023-11-08T04:12:19.713890Z

Severity

5.0 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N CVSS Calculator

Summary

xwiki-platform-web-templates allows users to be created even when registration is disabled without validation via template macro

Details

Impact

If a guest has view rights on any document, it's possible to create a new user using the distribution/firstadminuser.wiki in the wrong context.

To reproduce:

On a wiki with view rights for guests but user registration disabled, open as guest <server>/xwiki/bin/view/Main?sheet=CKEditor.HTMLConverter&language=en&sourceSyntax=xwiki%2F2.1&stripHTMLEnvelope=true&fromHTML=false&toHTML=true&text=%7B%7Btemplate+name%3D%22distribution%2Ffirstadminuser.wiki%22+%2F%7D%7D where <server> is the URL of your XWiki installation.
Enter username and password of your choice.
Click "Register and login"

Patches

The vulnerability has been patched in XWiki 15.0-rc-1 and 14.10.1.

Workarounds

There is no known workaround other than upgrading.

References

https://jira.xwiki.org/browse/XWIKI-19852 https://jira.xwiki.org/browse/XWIKI-20400

For more information

If you have any questions or comments about this advisory: * Open an issue in Jira XWiki.org * Email us at Security Mailing List

Database specific

{
    "nvd_published_at": "2023-04-19T00:15:08Z",
    "cwe_ids": [
        "CWE-284"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2023-04-20T21:39:56Z"
}

References

Affected packages

Maven / org.xwiki.platform:xwiki-platform-web-templates

Package

Name: org.xwiki.platform:xwiki-platform-web-templates; View open source insights on deps.dev
Purl: pkg:maven/org.xwiki.platform/xwiki-platform-web-templates

Affected ranges

Type: ECOSYSTEM
Events: Introduced

8.0-rc-1

Fixed

14.10.1