Description (CNA)
XWiki Platform is a generic wiki platform. Prior to 15.10.15, 16.4.6, and 16.10.0, any user can exploit the WikiManager REST API to create a new wiki, where the user could become an administrator and so performs other attacks on the farm. Note that this REST API is not bundled in XWiki Standard by default: it needs to be installed manually through the extension manager. The problem has been patched in versions 15.10.15, 16.4.6 and 16.10.0 of the REST module.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| xwiki / xwiki-platform | affected >= 5.4-rc-1, < 15.10.15; affected >= 16.0.0-rc-1, < 16.4.6; affected >= 16.5.0-rc-1, < 16.10.0 |
CWE
CWE-285
References
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-gfp2-6qhm-7x43
- https://github.com/xwiki/xwiki-platform/commit/82aa670106c7f5e6238ca6ed59a52d1800e05b99
- https://jira.xwiki.org/browse/XWIKI-22490
ADP enrichment
No English description supplied.
No references supplied.