PT-2007-6002 · Xwiki · Xwiki

Published 2007-09-14 · Updated 2008-11-15 · CVE-2007-4888

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: XWiki versions 1.0 B1 through 1.0 B2

Description: The issue allows remote authenticated users to read arbitrary documents due to the doc variable being associated with the entire document content and metadata, regardless of a user's view rights. This can be exploited via a custom skin that prints the content attribute of the doc variable.

Recommendations: For XWiki versions 1.0 B1 and 1.0 B2, consider restricting access to the doc variable or implementing custom view rights to prevent unauthorized access to documents. As a temporary workaround, avoid using custom skins that print the content attribute of the doc variable until a proper fix is available.

Fix

Related Identifiers

CVE-2007-4888

Affected Products

Xwiki

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2007-4888 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4888 · Note
• http://jira.xwiki.org/jira/browse/XWIKI-726 · Note
• http://osvdb.org/40499 · Note