Unauthenticated user can retrieve the list of users through uorgsuggest.vm

GHSA-97jg-43c9-q6pf · CVE-2022-24819

Published Apr 8, 2022 · Modified Nov 8, 2023

Description

A guest user without the right to view pages of the wiki can still list documents related to users of the wiki. The problem has been patched in XWiki versions 12.10.11, 13.4.4, and 13.9-rc-1. There is no known workaround for this problem.

References

WEB https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-97jg-43c9-q6pf
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2022-24819
PACKAGE https://github.com/xwiki/xwiki-platform
WEB https://jira.xwiki.org/browse/XWIKI-18850

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes