If a guest has view rights on any document, it's possible to create a new user using the distribution/firstadminuser.wiki
in the wrong context.
To reproduce:
The vulnerability has been patched in XWiki 15.0-rc-1 and 14.10.1.
There is no known workaround other than upgrading.
https://jira.xwiki.org/browse/XWIKI-19852 https://jira.xwiki.org/browse/XWIKI-20400
If you have any questions or comments about this advisory: * Open an issue in Jira XWiki.org * Email us at Security Mailing List
{ "nvd_published_at": "2023-04-19T00:15:08Z", "cwe_ids": [ "CWE-284" ], "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2023-04-20T21:39:56Z" }