Skip to content

URL Redirection to Untrusted Site ('Open Redirect')

Moderate
tmortagne published GHSA-jp55-vvmf-63mv Feb 9, 2022

Package

maven org.xwiki.platform:xwiki-platform-oldcore (Maven)

Affected versions

< 12.10.7, < 13.3RC1

Patched versions

12.10.7, 13.3RC1

Description

Impact

There's no protection against URL redirection to untrusted site, in particular some well known parameters (xredirect) can be used to perform such redirections.

Patches

The problem has been patched in XWiki 12.10.7 and XWiki 13.3RC1.

Workarounds

There's no known workaround for this issue.

References

https://jira.xwiki.org/browse/XWIKI-10309

For more information

If you have any questions or comments about this advisory:

Severity

Moderate
4.7
/ 10

CVSS base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
None
Availability
None
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

CVE ID

CVE-2022-23618

Weaknesses