PT-2024-21295 · Xwiki · Xwiki Application Licensing

Oanalavinia · Published 2024-02-21 · Updated 2024-02-22 · CVE-2024-26138

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions XWiki Application Licensing versions prior to 1.24.2

Description The XWiki licensor application includes a public document Licenses.Code.LicenseJSON that exposes sensitive information, including the instance's id, first and last name, and email of the license owner. This information leak can be used for targeted phishing attacks. The instance id can be associated with active installs data, and email addresses might be displayed obfuscated depending on the configuration.

Recommendations For versions prior to 1.24.2, upgrade to Application Licensing 1.24.2 to fix the issue. There are no known workarounds besides upgrading. As a temporary workaround, consider restricting access to the Licenses.Code.LicenseJSON document until the upgrade is applied.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2024-26138

GHSA-4HFP-M9GV-M753

Affected Products

Xwiki Application Licensing

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/26xxx/CVE-2024-26138.json · Exploit
• https://github.com/xwikisas/application-licensing/security/advisories/GHSA-4hfp-m9gv-m753 · Vendor Advisory
• https://github.com/xwikisas/application-licensing/commit/d168fb88fc0d121bf95e769ea21c55c00bebe5a6 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-26138 · Security Note
• https://osv.dev/vulnerability/CVE-2024-26138 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4hfp-m9gv-m753 · Vendor Advisory
• https://github.com/xwikisas/application-licensing · Note
• https://extensions.xwiki.org/xwiki/bin/view/Extension/Active%20Installs%202%20API · Note
• https://twitter.com/CVEnew/status/1760356373924389057 · Twitter Post