PT-2023-22205 · Xwiki · Xwiki Commons

Tmortagne · Published 2023-04-12 · Updated 2023-04-25 · CVE-2023-29208

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions XWiki Commons versions prior to 14.10

Description The issue concerns rights added to a document not being taken into account for viewing it once it's deleted. This specifically impacts deleted documents that contained view rights. However, view rights provided on a space of a deleted document are properly checked. The problem has been resolved by checking the rights of the current user, allowing only admins and the deleter of the document to view it.

Recommendations For versions prior to 14.10, update to XWiki 14.10 to resolve the issue by implementing the patch that checks the rights of the current user, restricting viewing of deleted documents to admins and the document's deleter.

Exploit

Fix

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-668

Related Identifiers

CVE-2023-29208

GHSA-4F8G-FQ6X-JQRR

Affected Products

Xwiki Commons

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/29xxx/CVE-2023-29208.json · Exploit
• 🔥 https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-4f8g-fq6x-jqrr · Exploit
• 🔥 https://jira.xwiki.org/browse/XWIKI-16285 · Exploit
• https://github.com/xwiki/xwiki-platform/commit/d9e947559077e947315bf700c5703dfc7dd8a8d7 · Patch
• https://osv.dev/vulnerability/GHSA-4f8g-fq6x-jqrr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-29208 · Security Note
• https://osv.dev/vulnerability/CVE-2023-29208 · Vendor Advisory
• https://github.com/xwiki/xwiki-platform · Note
• https://t.me/cvenotify/48340 · Telegram Post
• https://t.me/cibsecurity/62233 · Telegram Post