GHSA-r5cr-xm48-97xp

Suggest an improvement
Source
https://github.com/advisories/GHSA-r5cr-xm48-97xp
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/04/GHSA-r5cr-xm48-97xp/GHSA-r5cr-xm48-97xp.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-r5cr-xm48-97xp
Aliases
Published
2025-04-30T16:49:47Z
Modified
2025-05-05T17:50:17Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
XWiki missing authorization when accessing the wiki level attachments list and metadata via REST API
Details

Impact

Anyone can access the metadata of any attachment in the wiki using the wiki attachment REST endpoint. It's not filtering the result depending on current user rights, a not authenticated user could exploit this even in a totally private wiki.

To reproduce:

  • remove view from guest on the whole wiki
  • logout
  • access http://127.0.0.1:8080/xwiki/rest/wikis/xwiki/spaces/Sandbox/pages/WebHome/attachments

You get a list of attachments, while the expected result should be an empty list.

Patches

This vulnerability has been fixed in XWiki 14.10.22, 15.10.12, 16.7.0-rc-1 and 16.4.3.

Workarounds

We're not aware of any workaround except upgrading.

References

For more information

If you have any questions or comments about this advisory:

Attribution

Issue reported by Lukas Monert.

Database specific 
{
    "cwe_ids":  [
        "CWE-862"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2025-04-30T16:49:47Z",
    "nvd_published_at":  "2025-04-30T19:15:55Z",
    "severity":  "MODERATE"
}
References

Affected packages

Maven
org.xwiki.platform:xwiki-platform-rest-server

Package

Name
org.xwiki.platform:xwiki-platform-rest-server
View open source insights on deps.dev
Purl
pkg:maven/org.xwiki.platform/xwiki-platform-rest-server

Affected ranges

Type
ECOSYSTEM
Events
Introduced
1.8.1
Fixed
14.10.22

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/04/GHSA-r5cr-xm48-97xp/GHSA-r5cr-xm48-97xp.json"
org.xwiki.platform:xwiki-platform-rest-server

Package

Name
org.xwiki.platform:xwiki-platform-rest-server
View open source insights on deps.dev
Purl
pkg:maven/org.xwiki.platform/xwiki-platform-rest-server

Affected ranges

Type
ECOSYSTEM
Events
Introduced
15.0-rc-1
Fixed
15.10.12

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/04/GHSA-r5cr-xm48-97xp/GHSA-r5cr-xm48-97xp.json"
org.xwiki.platform:xwiki-platform-rest-server

Package

Name
org.xwiki.platform:xwiki-platform-rest-server
View open source insights on deps.dev
Purl
pkg:maven/org.xwiki.platform/xwiki-platform-rest-server

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16.0.0-rc-1
Fixed
16.4.3

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/04/GHSA-r5cr-xm48-97xp/GHSA-r5cr-xm48-97xp.json"
org.xwiki.platform:xwiki-platform-rest-server

Package

Name
org.xwiki.platform:xwiki-platform-rest-server
View open source insights on deps.dev
Purl
pkg:maven/org.xwiki.platform/xwiki-platform-rest-server

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16.5.0-rc-1
Fixed
16.7.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/04/GHSA-r5cr-xm48-97xp/GHSA-r5cr-xm48-97xp.json"