Description
XWiki is an open-source wiki software platform. From 16.7.0 to 16.10.11, 17.4.4, or 17.7.0, in an instance which is using the XWiki Jetty package (XJetty), a context is exposed to statically access any file located in the webapp/ folder. It allows accessing files which might contains credentials. Fixed in 16.10.11, 17.4.4, and 17.7.0.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
xwiki xwiki-platform
>= 16.7.0, < 16.10.11affected>= 17.0.0-rc1, < 17.4.4affected>= 17.5.0, < 17.7.0affected
References
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-53gx-j3p6-2rw9 ↗
- https://github.com/xwiki/xwiki-platform/commit/42fb063749dd88cc78196f72d7318b7179285ebd ↗
- https://github.com/xwiki/xwiki-platform/commit/99a04a0e2143583f5154a43e02174155da7e8e10 ↗
- https://github.com/xwiki/xwiki-platform/compare/8b68d8a70b43f25391b3ee48477d7eb71b95cf4b...99a04a0e2143583f5154a43e02174155da7e8e10 ↗
- https://jira.xwiki.org/browse/XWIKI-23438 ↗