CVE-2023-34466
published 2023-06-23CVE-2023-34466: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 5.0-milestone-1 and prior to…
PriorityP422medium4.3CVSS 3.1
AVNACLPRLUINSUCLINAN
EPSS
0.55%
42.1th percentile
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 5.0-milestone-1 and prior to versions 14.4.8, 14.10.4, and 15.0-rc-1, tags from pages not viewable to the current user are leaked by the tags API. This information can also be exploited to infer the document reference of non-viewable pages. This vulnerability has been patched in XWiki 14.4.8, 14.10.4, and 15.0-rc-1.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| xwiki | xwiki | — | — |
| xwiki | xwiki | >= 14.10 < 14.10.4 | 14.10.4 |
| xwiki | xwiki | >= 5.0.1 < 14.4.8 | 14.4.8 |
| xwiki | xwiki-platform | — | — |
| xwiki | xwiki-platform | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
XWiki Platform's tags on non-viewable pages can be revealed to users
osv·2023-06-20
CVE-2023-34466 [MEDIUM] XWiki Platform's tags on non-viewable pages can be revealed to users
XWiki Platform's tags on non-viewable pages can be revealed to users
### Impact
Tags from pages not viewable to the current user are leaked by the tags API.
This information can also be exploited to infer the document reference of non-viewable pages.
### Patches
This vulnerability has been patched in XWiki 14.4.8, 14.10.4, and 15.0 RC1.
### Workarounds
There is no workaround apart from upgrading to a fixed version.
### References
- https://jira.xwiki.org/browse/XWIKI-20002
### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)
* Email us at [Security Mailing List](mailto:[email protected])
GHSA
XWiki Platform's tags on non-viewable pages can be revealed to users
ghsa·2023-06-20
CVE-2023-34466 [MEDIUM] CWE-200 XWiki Platform's tags on non-viewable pages can be revealed to users
XWiki Platform's tags on non-viewable pages can be revealed to users
### Impact
Tags from pages not viewable to the current user are leaked by the tags API.
This information can also be exploited to infer the document reference of non-viewable pages.
### Patches
This vulnerability has been patched in XWiki 14.4.8, 14.10.4, and 15.0 RC1.
### Workarounds
There is no workaround apart from upgrading to a fixed version.
### References
- https://jira.xwiki.org/browse/XWIKI-20002
### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)
* Email us at [Security Mailing List](mailto:[email protected])
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2023-06-23
Published