Exposure of Private Personal Information to an Unauthorized Actor in org.xwiki.platform:xwiki-platform-rest-server
Moderate severity
GitHub Reviewed
Published
Nov 21, 2022
in
xwiki/xwiki-platform
•
Updated Jan 31, 2023
Package
Affected versions
>= 8.1, < 13.10.8
>= 14.0.0, < 14.4.3
>= 14.5.0, < 14.6
Patched versions
13.10.8
14.4.3
14.6
Description
Published to the GitHub Advisory Database
Nov 21, 2022
Reviewed
Nov 21, 2022
Published by the National Vulnerability Database
Nov 22, 2022
Last updated
Jan 31, 2023
Impact
The
modificationsrest endpoint does not filter out entries according to the user's rights. Therefore, information hidden from unauthorized users are exposed though themodificationsrest endpoint (e.g., comments, page names...).Patches
Users should upgrade to XWiki 14.6+, 14.4.3+, or13.10.8+. Older versions have not been patched.
Workarounds
No known workaround.
References
For more information
If you have any questions or comments about this advisory:
References