Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

org.xwiki.platform:xwiki-platform-security

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.1MavenPublished

    XWiki Platform Security Parent POM vulnerable to overwriting of security rules of a page with a final page having the same reference

    CVE-2022-31167 · GHSA-gg53-wf5x-r3r6

    Affected
    • Maven org.xwiki.platform:xwiki-platform-security >= 5.0, < 12.10.11; >= 13.0, < 13.4.6; >= 13.10, < 13.10.1
    Fixed in
    13.4.613.10.112.10.11· Vendor fix available
    Issue
    Impact A bug in the security cache is storing rules associated to document Page1.Page2 and space Page1.Page2 in the same cache entry. That means that it's possible to overwrite the rights of a space or a document by creating the page of the space with the same name and checking the right of the new one first so that they end up in the security cache and are used for the other too. Patches The problem has been patched in XWiki 12.10.11, 13.10.1, 13.4.6. Workarounds No workaround other than patching. References https://jira.xwiki.org/browse/XWIKI-14075 https://jira.xwiki.org/browse/XWIKI-18983 For more information If you have any questions or comments about this advisory: Open an issue in Jira XWiki.org Email us at Security Mailing List

    Recommended action: Upgrade to 13.10.1, 13.4.6 or 12.10.11 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →