PT-2023-22205 · Xwiki · Xwiki Commons

Tmortagne · Publicado 2023-04-12 · Atualizado 2023-04-25 · CVE-2023-29208

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions XWiki Commons versions prior to 14.10

Description The issue concerns rights added to a document not being taken into account for viewing it once it's deleted. This specifically impacts deleted documents that contained view rights. However, view rights provided on a space of a deleted document are properly checked. The problem has been resolved by checking the rights of the current user, allowing only admins and the deleter of the document to view it.

Recommendations For versions prior to 14.10, update to XWiki 14.10 to resolve the issue by implementing the patch that checks the rights of the current user, restricting viewing of deleted documents to admins and the document's deleter.

Exploit

Correção

Exposure of Resource to Wrong Sphere

Enumeração de Fraquezas

CWE-668

Identificadores relacionados

CVE-2023-29208

GHSA-4F8G-FQ6X-JQRR

Produtos afetados

Xwiki Commons

Referências · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/29xxx/CVE-2023-29208.json · Exploit
• 🔥 https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-4f8g-fq6x-jqrr · Exploit
• 🔥 https://jira.xwiki.org/browse/XWIKI-16285 · Exploit
• https://github.com/xwiki/xwiki-platform · Nota
• https://github.com/xwiki/xwiki-platform/commit/d9e947559077e947315bf700c5703dfc7dd8a8d7 · Correção
• https://osv.dev/vulnerability/GHSA-4f8g-fq6x-jqrr · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-29208 · Nota de Segurança
• https://t.me/cvenotify/48340 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-29208 · Aviso do Fabricante
• https://t.me/cibsecurity/62233 · Publicação no Telegram