PT-2023-24894 · Xwiki · Xwiki Platform

Manuel Leduc · Publicado 2023-06-20 · Atualizado 2023-06-30 · CVE-2023-34466

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions XWiki Platform versions 5.0-milestone-1 through 14.4.7 XWiki Platform versions 14.4.8 is not affected, but versions prior to 14.10.4 are affected XWiki Platform versions prior to 15.0-rc-1

Description The XWiki Platform leaks tags from pages not viewable to the current user through the tags API. This information can also be exploited to infer the document reference of non-viewable pages.

Recommendations For XWiki Platform versions 5.0-milestone-1 through 14.4.7, update to version 14.4.8 or later. For XWiki Platform versions prior to 14.10.4, update to version 14.10.4 or later. For XWiki Platform versions prior to 15.0-rc-1, update to version 15.0-rc-1 or later. As a temporary workaround, consider restricting access to the tags API until a patch is available.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2023-34466

GHSA-7F2F-PCV3-J2R7

Produtos afetados

Xwiki Platform

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/34xxx/CVE-2023-34466.json · Exploit
• 🔥 https://jira.xwiki.org/browse/XWIKI-20002 · Exploit
• https://github.com/xwiki/xwiki-platform · Nota
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-7f2f-pcv3-j2r7 · Aviso do Fabricante
• https://t.me/cibsecurity/65475 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-34466 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-34466 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-7f2f-pcv3-j2r7 · Aviso do Fabricante