CVE-2022-24820
08.04.2022, 20:15
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A guest user without the right to view pages of the wiki can still list documents by rendering some velocity documents. The problem has been patched in XWiki versions 12.10.11, 13.4.4, and 13.9-rc-1. There is no known workaround for this problem.Enginsight
| Vendor | Product | Version |
|---|---|---|
| xwiki | xwiki | 𝑥 < 12.10.11 |
| xwiki | xwiki | 13.4.0 ≤ 𝑥 < 13.4.4 |
| xwiki | xwiki | 13.9 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-359 - Exposure of Private Personal Information to an Unauthorized ActorThe product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected.
- CWE-306 - Missing Authentication for Critical FunctionThe product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.