GHSA-fp36-mjw5-fmgx

Suggest an improvement
Source
https://github.com/advisories/GHSA-fp36-mjw5-fmgx
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/04/GHSA-fp36-mjw5-fmgx/GHSA-fp36-mjw5-fmgx.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-fp36-mjw5-fmgx
Aliases
Published
2023-04-20T21:39:56Z
Modified
2023-11-08T04:12:19.713890Z
Severity
  • 5.0 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N CVSS Calculator
Summary
xwiki-platform-web-templates allows users to be created even when registration is disabled without validation via template macro
Details

Impact

If a guest has view rights on any document, it's possible to create a new user using the distribution/firstadminuser.wiki in the wrong context.

To reproduce:

  • On a wiki with view rights for guests but user registration disabled, open as guest <server>/xwiki/bin/view/Main?sheet=CKEditor.HTMLConverter&language=en&sourceSyntax=xwiki%2F2.1&stripHTMLEnvelope=true&fromHTML=false&toHTML=true&text=%7B%7Btemplate+name%3D%22distribution%2Ffirstadminuser.wiki%22+%2F%7D%7D where <server> is the URL of your XWiki installation.
  • Enter username and password of your choice.
  • Click "Register and login"

Patches

The vulnerability has been patched in XWiki 15.0-rc-1 and 14.10.1.

Workarounds

There is no known workaround other than upgrading.

References

https://jira.xwiki.org/browse/XWIKI-19852 https://jira.xwiki.org/browse/XWIKI-20400

For more information

If you have any questions or comments about this advisory: * Open an issue in Jira XWiki.org * Email us at Security Mailing List

Database specific
{
    "nvd_published_at": "2023-04-19T00:15:08Z",
    "cwe_ids": [
        "CWE-284"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2023-04-20T21:39:56Z"
}
References

Affected packages

Maven / org.xwiki.platform:xwiki-platform-web-templates

Package

Name
org.xwiki.platform:xwiki-platform-web-templates
View open source insights on deps.dev
Purl
pkg:maven/org.xwiki.platform/xwiki-platform-web-templates

Affected ranges

Type
ECOSYSTEM
Events
Introduced
8.0-rc-1
Fixed
14.10.1