PT-2023-26180 · Xwiki · Xwiki Platform

Michael Hamann · Published 2023-10-25 · Updated 2023-10-31 · CVE-2023-37911

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions XWiki Platform versions 9.4-rc-1 through 14.10.7 XWiki Platform versions 15.3-rc-1 and earlier

Description The issue arises when a document has been deleted and re-created, allowing users with view rights on the re-created document but not on the deleted document to view the contents of the deleted document. This can be exploited through the diff feature and partially through the REST API by using versions such as deleted:1. Given sufficient rights, the attacker can also re-create the deleted document, extending the scope to any deleted document as long as the attacker has edit rights in the location of the deleted document.

Recommendations For XWiki Platform versions 9.4-rc-1 through 14.10.7, update to version 14.10.8 to properly check rights when deleted revisions of a document are accessed. For XWiki Platform versions 15.3-rc-1 and earlier, update to version 15.3 RC1 to properly check rights when deleted revisions of a document are accessed. As a temporary workaround, consider regularly cleaning deleted documents to minimize the potential exposure. Extra care should be taken when deleting sensitive documents that are protected individually or deleting a protected space as a whole.

Exploit

Fix

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-668

Related Identifiers

CVE-2023-37911

GHSA-GH64-QXH5-4M33

Affected Products

Xwiki Platform

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/37xxx/CVE-2023-37911.json · Exploit
• 🔥 https://jira.xwiki.org/browse/XWIKI-20684 · Exploit
• 🔥 https://jira.xwiki.org/browse/XWIKI-20817 · Exploit
• 🔥 https://jira.xwiki.org/browse/XWIKI-20685 · Exploit
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-gh64-qxh5-4m33 · Vendor Advisory
• https://github.com/xwiki/xwiki-platform/commit/f471f2a392aeeb9e51d59fdfe1d76fccf532523f · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-37911 · Security Note
• https://osv.dev/vulnerability/GHSA-gh64-qxh5-4m33 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-37911 · Vendor Advisory
• https://github.com/xwiki/xwiki-platform · Note
• https://extensions.xwiki.org/xwiki/bin/view/Extension/Index%20Application#HPermanentlydeleteallpages · Note