GHSA-97jg-43c9-q6pf

ghsaUSosv

Unauthenticated user can retrieve the list of users through uorgsuggest.vm

view advisory published 2022-04-08Licence: CC-BY-4.0

A guest user without the right to view pages of the wiki can still list documents related to users of the wiki. The problem has been patched in XWiki versions 12.10.11, 13.4.4, and 13.9-rc-1. There is no known workaround for this problem.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2022-24819US	medium5.3	3.20% (88th)	—	2022-04-08
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A guest user without the right to view pages of the wiki can still list doc…

references

External citations — patches, advisories, analysis.

https://github.com/xwiki/xwiki-platformPACKAGE
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-97jg-43c9-q6pfWEB
https://jira.xwiki.org/browse/XWIKI-18850WEB
https://nvd.nist.gov/vuln/detail/CVE-2022-24819ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan