What is GHSA-7f2f-pcv3-j2r7?

GHSA-7f2f-pcv3-j2r7 is a security advisory published by GitHub Security Advisories with Medium severity. XWiki Platform's tags on non-viewable pages can be revealed to users

Which CVE IDs does GHSA-7f2f-pcv3-j2r7 cover?

GHSA-7f2f-pcv3-j2r7 covers the following CVE IDs: CVE-2023-34466. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-7f2f-pcv3-j2r7?

GHSA-7f2f-pcv3-j2r7 has a CVSS v3 base score of 4.3, published by GitHub Security Advisories.

Which products are affected by GHSA-7f2f-pcv3-j2r7?

GHSA-7f2f-pcv3-j2r7 affects 2 products, including: maven/org.xwiki.platform:xwiki-platform-tag-api:\u003e= 5.0-milestone-1, \u003c 14.4.8; maven/org.xwiki.platform:xwiki-platform-tag-api:\u003e= 14.5, \u003c 14.10.4.

GHSA-7f2f-pcv3-j2r7MediumCVSS 4.3

XWiki Platform's tags on non-viewable pages can be revealed to users

Vendor

GitHub Security Advisories

Published

June 20, 2023

Last Modified

November 4, 2023

🔗 CVE IDs covered (1)

CVE-2023-34466 →

📋 Description

Impact

Tags from pages not viewable to the current user are leaked by the tags API. This information can also be exploited to infer the document reference of non-viewable pages.

Patches

This vulnerability has been patched in XWiki 14.4.8, 14.10.4, and 15.0 RC1.

Workarounds

There is no workaround apart from upgrading to a fixed version.

References

https://jira.xwiki.org/browse/XWIKI-20002

For more information

If you have any questions or comments about this advisory:

Open an issue in Jira XWiki.org
Email us at Security Mailing List

🎯 Affected products2

maven/org.xwiki.platform:xwiki-platform-tag-api:>= 5.0-milestone-1, < 14.4.8
maven/org.xwiki.platform:xwiki-platform-tag-api:>= 14.5, < 14.10.4

🔗 References (4)

https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-7f2f-pcv3-j2r7
https://jira.xwiki.org/browse/XWIKI-20002
https://nvd.nist.gov/vuln/detail/CVE-2023-34466
https://github.com/advisories/GHSA-7f2f-pcv3-j2r7