XWiki allows unregistered users to access private pages information through REST endpoint (xwiki xwiki-platform)
En bref
- Source
- NVD
- EPSS
- EPSS 0.95 % · centile 61 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- GitHub_M
- Statut NVD
- Analyzed
Rechercher sur…
Description
XWiki Platform is a generic wiki platform. Prior to 15.10.14, 16.4.6, and 16.10.0-rc-1, protected pages are listed when requesting the REST endpoints /rest/wikis/[wikiName]/pages even if the user doesn't have view rights on them. It's particularly true if the entire wiki is protected with "Prevent unregistered user to view pages": the endpoint would still list the pages of the wiki, though only for the main wiki. The problem has been patched in XWiki 15.10.14, 16.4.6, 16.10.0RC1. In those versions the endpoint can still be requested but the result is filtered out based on pages rights.
Faiblesses (CWE)
- CWE-402 — Transmission de ressources privées vers une nouvelle sphère
Références
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-22q5-9phm-744v
- https://github.com/xwiki/xwiki-platform/commit/1fb12d2780f37b34a1b4dfdf8457d97ce5cbb2df
- https://github.com/xwiki/xwiki-platform/commit/bca72f5ce971a31dba2a016d8dd8badda4475206
- https://jira.xwiki.org/browse/XWIKI-22630
- https://jira.xwiki.org/browse/XWIKI-22639
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 4.0 | HIGH 8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | GitHub_M |
| CVSS 4.0 | HIGH 8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X | NVD · security-advisories@github.com (Secondary) |
| CVSS 3.1 | MEDIUM 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N | NVD · nvd@nist.gov (Primary) |
Avis
- GHSA-22q5-9phm-744v — XWiki allows unregistered users to access private pages information through REST endpoint
Références européennes
- ENISA EUVD · EUVD-2025-6735
- GCVE · GCVE-0-2025-29925
Configurations affectées (CPE NVD)
cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*≥ 1.9 < 15.10.14cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*≥ 16.0.0 < 16.4.6cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*≥ 16.5.0 ≤ 16.10.0
Produits affectés
| Produit | Versions |
|---|---|
| xwiki · xwiki-platform | affected >= 1.9M1, < 15.10.14 ; affected >= 16.0.0-rc-1, < 16.4.6 ; affected >= 16.5.0-rc-1, < 16.10.0-rc-1 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |