PT-2023-24894 · Xwiki · Xwiki Platform

Manuel Leduc · Published 2023-06-20 · Updated 2023-06-30 · CVE-2023-34466

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions XWiki Platform versions 5.0-milestone-1 through 14.4.7 XWiki Platform versions 14.4.8 is not affected, but versions prior to 14.10.4 are affected XWiki Platform versions prior to 15.0-rc-1

Description The XWiki Platform leaks tags from pages not viewable to the current user through the tags API. This information can also be exploited to infer the document reference of non-viewable pages.

Recommendations For XWiki Platform versions 5.0-milestone-1 through 14.4.7, update to version 14.4.8 or later. For XWiki Platform versions prior to 14.10.4, update to version 14.10.4 or later. For XWiki Platform versions prior to 15.0-rc-1, update to version 15.0-rc-1 or later. As a temporary workaround, consider restricting access to the tags API until a patch is available.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2023-34466

GHSA-7F2F-PCV3-J2R7

Affected Products

Xwiki Platform

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/34xxx/CVE-2023-34466.json · Exploit
• 🔥 https://jira.xwiki.org/browse/XWIKI-20002 · Exploit
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-7f2f-pcv3-j2r7 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-34466 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-34466 · Security Note
• https://osv.dev/vulnerability/GHSA-7f2f-pcv3-j2r7 · Vendor Advisory
• https://github.com/xwiki/xwiki-platform · Note
• https://t.me/cibsecurity/65475 · Telegram Post