XWiki Platform Web Templates prior 13.10.4/14.2 Suggestion private personal information

Summaryinfo

A vulnerability marked as problematic has been reported in XWiki Platform Web Templates. The impacted element is an unknown function of the component Suggestion Handler. Performing a manipulation results in private personal information. This vulnerability is cataloged as CVE-2022-36091. It is possible to initiate the attack remotely. There is no exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in XWiki Platform Web Templates (Content Management System). It has been classified as problematic. This affects an unknown code of the component Suggestion Handler. The manipulation with an unknown input leads to a private personal information vulnerability. CWE is classifying the issue as CWE-359. The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected. This is going to have an impact on confidentiality. The summary by CVE is:

XWiki Platform Web Templates are templates for XWiki Platform, a generic wiki platform. Through the suggestion feature, string and list properties of objects the user shouldn't have access to can be accessed in versions prior to 13.10.4 and 14.2. This includes private personal information like email addresses and salted password hashes of registered users but also other information stored in properties of objects. Sensitive configuration fields like passwords for LDAP or SMTP servers could be accessed. By exploiting an additional vulnerability, this issue can even be exploited on private wikis at least for string properties. The issue is patched in version 13.10.4 and 14.2. Password properties are no longer displayed and rights are checked for other properties. A workaround is available. The template file `suggest.vm` can be replaced by a patched version without upgrading or restarting XWiki unless it has been overridden, in which case the overridden template should be patched, too. This might need adjustments for older versions, though.

The weakness was shared 09/09/2022 as GHSA-599v-w48h-rjrm. The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2022-36091 since 07/15/2022. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1589 for this issue.

Upgrading to version 13.10.4 or 14.2 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Content Management System

Name

• XWiki Platform Web Templates

License

• open-source

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion