CVE-2022-41935 : XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users without t

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users without the right to view documents can deduce their existence by repeated Livetable queries. The issue has been patched in XWiki 14.6RC1, 13.10.8, and 14.4.3, the response is not properly cleaned up of obfuscated entries. As a workaround, The patch for the document `XWiki.LiveTableResultsMacros` can be manually applied or a XAR archive of a patched version can be imported, on versions 12.10.11, 13.9-rc-1, and 13.4.4. There are no known workarounds for this issue.

Published 2022-11-23 20:15:10

Updated 2023-07-06 13:37:01

Source GitHub, Inc.

View at NVD, CVE.org

Vulnerability category: Information leak

Exploit prediction scoring system (EPSS) score for CVE-2022-41935

EPSS FAQ

0.06%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 27 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-41935

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N	2.8	1.4	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: None Availability: None
5.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	3.9	1.4	GitHub, Inc.
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: None Availability: None

CWE ids for CVE-2022-41935

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Assigned by: security-advisories@github.com (Secondary)

References for CVE-2022-41935

https://jira.xwiki.org/browse/XWIKI-19999

[XWIKI-19999] Livetable results allow reconstructing title, content and object fields of inaccessible documents with many requests - XWiki.org JIRA
Exploit;Issue Tracking;Patch;Vendor Advisory
https://github.com/xwiki/xwiki-platform/commit/1450b6e3c69ac7df25e5a2571186d1f43402facd#diff-5a739e5865b1f1ad9d79b724791be51b0095a0170cc078911c940478b13b949a

XWIKI-19999: Livetable sources filtering improvement · xwiki/xwiki-platform@1450b6e · GitHub
Patch;Third Party Advisory
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-p2x4-6ghr-6vmq

Exposure of Sensitive Information to an Unauthorized Actor in org.xwiki.platform:xwiki-platform-livetable-ui · Advisory · xwiki/xwiki-platform · GitHub
Exploit;Patch;Third Party Advisory

Products affected by CVE-2022-41935

Xwiki » Xwiki
Versions from including (>=) 14.0.0 and before (<) 14.4.3
cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*
Matching versions
Xwiki » Xwiki
Versions from including (>=) 12.10.11 and before (<) 13.10.8
cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*
Matching versions
Xwiki » Xwiki » Version: 14.4.4
cpe:2.3:a:xwiki:xwiki:14.4.4:*:*:*:*:*:*:*
Matching versions
Xwiki » Xwiki » Version: 14.4.5
cpe:2.3:a:xwiki:xwiki:14.4.5:*:*:*:*:*:*:*
Matching versions

Vulnerability Details : CVE-2022-41935

Exploit prediction scoring system (EPSS) score for CVE-2022-41935

CVSS scores for CVE-2022-41935

CWE ids for CVE-2022-41935

References for CVE-2022-41935

Products affected by CVE-2022-41935