7.5

CVE-2022-41936

Exposure of Private Personal Information to an Unauthorized Actor in xwiki-platform-rest-server

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The `modifications` rest endpoint does not filter out entries according to the user's rights. Therefore, information hidden from unauthorized users are exposed though the `modifications` rest endpoint (comments and page names etc). Users should upgrade to XWiki 14.6+, 14.4.3+, or 13.10.8+. Older versions have not been patched. There are no known workarounds.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Xwiki ≫ Xwiki Version >= 8.1 < 13.10.8
Xwiki ≫ Xwiki Version >= 14.0 < 14.4.3
Xwiki ≫ Xwiki Version >= 14.5 < 14.6
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.72% 0.491
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
security-advisories@github.com 5.3 3.9 1.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CWE-359 Exposure of Private Personal Information to an Unauthorized Actor

The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected.

https://github.com/xwiki/xwiki-platform/commit/38dc1aa1a4435f24d58f5b8e4566cbcb0971f8ff
Patch
Third Party Advisory
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-p88w-fhxw-xvcc
Patch
Third Party Advisory
https://jira.xwiki.org/browse/XWIKI-19997
Vendor Advisory