deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-36088
Published: 2022-09-07
Description: GoCD is a continuous delivery server. Windows installations via either the server or agent installers for GoCD prior to 22.2.0 do not adequately restrict permissions when installing outside of the default location. This could allow a malicious user with local access to the server GoCD Server or Agent are installed on to modify executables or components of the installation. This does not affect zip file-based installs, installations to other platforms, or installations inside `Program Files` or `Program Files (x86)`. This issue is fixed in GoCD 22.2.0 installers. As a workaround, if the server or agent is installed outside of `Program Files (x86)`, verify the the permission of the Server or Agent installation directory to ensure the `Everyone` user group does not have `Full Control`, `Modify` or `Write` permissions.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-269, CWE-284
References: https://github.com/gocd/gocd/commit/96add9605096ab50c5cd4c229be1d503aff506a6; https://github.com/gocd/gocd/releases/tag/22.2.0; https://github.com/gocd/gocd/security/advisories/GHSA-gpv4-xqhc-5vcj
CVE: CVE-2022-36089
Published: 2022-09-07
Description: KubeVela is an application delivery platform Users using KubeVela's VelaUX APIServer could be affected by an authentication bypass vulnerability. In KubeVela prior to versions 1.4.11 and 1.5.4, VelaUX APIServer uses the `PlatformID` as the signed key to generate the JWT tokens for users. Another API called `getSystemInfo` exposes the platformID. This vulnerability allows users to use the platformID to re-generate the JWT tokens to bypass the authentication. Versions 1.4.11 and 1.5.4 contain a patch for this issue.
CVSS Score: 8.2 (HIGH)
CWE: CWE-294
References: https://github.com/kubevela/kubevela/pull/4634; https://github.com/kubevela/kubevela/security/advisories/GHSA-cq42-w295-r29q; https://github.com/kubevela/kubevela/pull/4634
CVE: CVE-2022-36585
Published: 2022-09-07
Description: In Tenda G3 US_G3V3.0br_V15.11.0.6(7663)_EN_TDE, in httpd binary, the addDhcpRule function has a buffer overflow caused by sscanf.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://github.com/Davidteeri/Bug-Report/blob/main/tenda-G3-0x62158.md; https://www.tendacn.com/download/detail-3401.html; https://github.com/Davidteeri/Bug-Report/blob/main/tenda-G3-0x62158.md
CVE: CVE-2021-34236
Published: 2022-09-08
Description: Buffer Overflow in Netgear R8000 Router with firmware v1.0.4.56 allows remote attackers to execute arbitrary code or cause a denial-of-service by sending a crafted POST to '/bd_genie_create_account.cgi' with a sufficiently long parameter 'register_country'.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://github.com/Davidteeri/Bug-Report/blob/main/netgear-8000.md; https://github.com/advisories/GHSA-vfq9-7wg3-4mjx; https://github.com/Davidteeri/Bug-Report/blob/main/netgear-8000.md
CVE: CVE-2022-36586
Published: 2022-09-08
Description: In Tenda G3 US_G3V3.0br_V15.11.0.6(7663)_EN_TDE, there is a buffer overflow vulnerability caused by strcpy in function 0x869f4 in the httpd binary.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://github.com/Davidteeri/Bug-Report/blob/main/tenda-G3-%200x869f4.md; https://www.tendacn.com/download/detail-3401.html; https://github.com/Davidteeri/Bug-Report/blob/main/tenda-G3-%200x869f4.md
CVE: CVE-2022-36588
Published: 2022-09-08
Description: In D-Link DAP1650 v1.04 firmware, the fileaccess.cgi program in the firmware has a buffer overflow vulnerability caused by strncpy.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://github.com/Davidteeri/Bug-Report/blob/main/dlink-dap1650-0x419EF8.md; https://support.dlink.com/ProductInfo.aspx?m=DAP-1650; https://www.dlink.com/en/security-bulletin/
CVE: CVE-2022-37777
Published: 2022-09-08
Description: Phicomm FIR151B A2, FIR302E A2, FIR300B A2, FIR303B A2 routers 3.0.1.17 and earlier were discovered to contain a remote command execution (RCE) vulnerability via the trHops parameter of the tracert function.
CVSS Score: 7.2 (HIGH)
References: https://github.com/SLoSnow9879/Phicomm_Router/blob/main/Tracert_2.md; https://github.com/SLoSnow9879/Phicomm_Router/blob/main/Tracert_2.md
CVE: CVE-2022-37778
Published: 2022-09-08
Description: Phicomm FIR151B A2, FIR302E A2, FIR300B A2, FIR303B A2 routers V3.0.1.17 were discovered to contain a remote command execution (RCE) vulnerability via the current_time parameter of the time function.
CVSS Score: 7.2 (HIGH)
References: https://github.com/SLoSnow9879/Phicomm_Router/blob/main/Time.md; https://github.com/SLoSnow9879/Phicomm_Router/blob/main/Time.md
CVE: CVE-2022-37779
Published: 2022-09-08
Description: Phicomm FIR151B A2, FIR302E A2, FIR300B A2, FIR303B A2 routers V3.0.1.17 were discovered to contain a remote command execution (RCE) vulnerability via the sendnum parameter of the ping function.
CVSS Score: 7.2 (HIGH)
References: https://github.com/SLoSnow9879/Feixun_Router/blob/main/Ping_1.md; https://github.com/SLoSnow9879/Feixun_Router/blob/main/Ping_1.md
CVE: CVE-2022-38531
Published: 2022-09-08
Description: FPT G-97RG6M R4.2.98.035 and G-97RG3 R4.2.43.078 are vulnerable to Remote Command Execution in the ping function.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://github.com/SLoSnow9879/FPT-Router-RCE; https://github.com/SLoSnow9879/FPT-Router-RCE
CVE: CVE-2022-37144
Published: 2022-09-08
Description: The PlexTrac platform prior to API version 1.17.0 does not restrict excessive MFA TOTP submission attempts. An unauthenticated remote attacker in possession of a valid username and password can bruteforce their way past MFA protections to login as the targeted user.
CVSS Score: 8.8 (HIGH)
CWE: CWE-307
References: http://plextrac.com; https://www.controlgap.com/blog/a-plextrac-story; http://plextrac.com
CVE: CVE-2022-37145
Published: 2022-09-08
Description: The PlexTrac platform prior to version 1.17.0 does not restrict excessive authentication attempts for accounts configured to use the PlexTrac authentication provider. An unauthenticated remote attacker could perform a bruteforce attack on the login page with no time or attempt limitation in an attempt to obtain valid credentials for the platform users configured to use the PlexTrac authentication provider.
CVSS Score: 7.5 (HIGH)
CWE: CWE-307
References: http://plextrac.com; https://www.controlgap.com/blog/a-plextrac-story; http://plextrac.com
CVE: CVE-2022-37146
Published: 2022-09-08
Description: The PlexTrac platform prior to version 1.28.0 allows for username enumeration via HTTP response times on invalid login attempts for users configured to use the PlexTrac authentication provider. Login attempts for valid, unlocked users configured to use PlexTrac as their authentication provider take significantly longer than those for invalid users, allowing for valid users to be enumerated by an unauthenticated remote attacker. Note that the lockout policy implemented in Plextrac version 1.17.0 makes it impossible to distinguish between valid, locked user accounts and user accounts that do not exist, but does not prevent valid, unlocked users from being enumerated.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-203
References: http://plextrac.com; https://www.controlgap.com/blog/a-plextrac-story; http://plextrac.com
CVE: CVE-2022-25897
Published: 2022-09-08
Description: The package org.eclipse.milo:sdk-server before 0.6.8 are vulnerable to Denial of Service (DoS) when bypassing the limitations for excessive memory consumption by sending multiple CloseSession requests with the deleteSubscription parameter equal to False.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-770
References: https://github.com/eclipse/milo/commit/[PII_REDACTED]d7d9f0bf00cbf6a8449bb0d13c6ce5; https://github.com/eclipse/milo/issues/1030; https://github.com/eclipse/milo/pull/1031
CVE: CVE-2022-25914
Published: 2022-09-08
Description: The package com.google.cloud.tools:jib-core before 0.22.0 are vulnerable to Remote Code Execution (RCE) via the isDockerInstalled function, due to attempting to execute input.
CVSS Score: 5.6 (MEDIUM)
References: https://github.com/GoogleContainerTools/jib/commit/67fa40bc2c484da[PII_REDACTED]ea07a89fe44eaaf; https://github.com/GoogleContainerTools/jib/pull/3744; https://security.snyk.io/vuln/SNYK-JAVA-COMGOOGLECLOUDTOOLS-2968871
CVE: CVE-2022-28220
Published: 2022-09-08
Description: Apache James prior to release 3.6.3 and 3.7.1 is vulnerable to a buffering attack relying on the use of the STARTTLS command. Fix of CVE-2021-38542, which solved similar problem fron Apache James 3.6.1, is subject to a parser differential and do not take into account concurrent requests.
CVSS Score: 7.5 (HIGH)
CWE: CWE-77, CWE-77
References: http://www.openwall.com/lists/oss-security/2022/09/20/1; https://james.apache.org/james/update/2022/08/26/james-3.7.1.html; http://www.openwall.com/lists/oss-security/2022/09/20/1
CVE: CVE-2022-33941
Published: 2022-09-08
Description: PowerCMS XMLRPC API provided by Alfasado Inc. contains a command injection vulnerability. Sending a specially crafted message by POST method to PowerCMS XMLRPC API may allow arbitrary Perl script execution, and an arbitrary OS command may be executed through it. Affected products/versions are as follows: PowerCMS 6.021 and earlier (PowerCMS 6 Series), PowerCMS 5.21 and earlier (PowerCMS 5 Series), and PowerCMS 4.51 and earlier (PowerCMS 4 Series). Note that all versions of PowerCMS 3 Series and earlier which are unsupported (End-of-Life, EOL) are also affected by this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://jvn.jp/en/jp/JVN76024879/index.html; https://www.powercms.jp/news/xmlrpc-api-provision-202208.html; https://jvn.jp/en/jp/JVN76024879/index.html
CVE: CVE-2022-34869
Published: 2022-09-08
Description: Undocumented hidden command that can be executed from the telnet function of CentreCOM AR260S V2 firmware versions prior to Ver.3.3.7 allows a remote authenticated attacker to execute an arbitrary OS command.
CVSS Score: 8.8 (HIGH)
References: https://jvn.jp/en/jp/JVN45473612/index.html; https://www.allied-telesis.co.jp/support/list/faq/vuls/20220829.html; https://jvn.jp/en/jp/JVN45473612/index.html
CVE: CVE-2022-35273
Published: 2022-09-08
Description: OS command injection vulnerability in GUI setting page of CentreCOM AR260S V2 firmware versions prior to Ver.3.3.7 allows a remote authenticated attacker to execute an arbitrary OS command.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://jvn.jp/en/jp/JVN45473612/index.html; https://www.allied-telesis.co.jp/support/list/faq/vuls/20220829.html; https://jvn.jp/en/jp/JVN45473612/index.html
CVE: CVE-2022-36403
Published: 2022-09-08
Description: Untrusted search path vulnerability in the installer of Device Software Manager prior to Ver.2.20.3.0 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: https://jvn.jp/en/jp/JVN44721267/index.html; https://www.ricoh.com/software/dev_soft_manager; https://jvn.jp/en/jp/JVN44721267/index.html
CVE: CVE-2022-38094
Published: 2022-09-08
Description: OS command injection vulnerability in the telnet function of CentreCOM AR260S V2 firmware versions prior to Ver.3.3.7 allows a remote authenticated attacker to execute an arbitrary OS command.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://jvn.jp/en/jp/JVN45473612/index.html; https://www.allied-telesis.co.jp/support/list/faq/vuls/20220829.html; https://jvn.jp/en/jp/JVN45473612/index.html
CVE: CVE-2022-38394
Published: 2022-09-08
Description: Use of hard-coded credentials for the telnet server of CentreCOM AR260S V2 firmware versions prior to Ver.3.3.7 allows a remote unauthenticated attacker to execute an arbitrary OS command.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://jvn.jp/en/jp/JVN45473612/index.html; https://www.allied-telesis.co.jp/support/list/faq/vuls/20220829.html; https://jvn.jp/en/jp/JVN45473612/index.html
CVE: CVE-2022-38399
Published: 2022-09-08
Description: Missing protection mechanism for alternate hardware interface in SmaCam CS-QR10 all versions and SmaCam Night Vision CS-QR20 all versions allows an attacker to execute an arbitrary OS command by having the product connect to the product's specific serial connection
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: https://jvn.jp/en/vu/JVNVU90766406/index.html; https://www.planex.co.jp/products/cs-qr10/index.shtml; https://www.planex.co.jp/products/cs-qr20/index.shtml
CVE: CVE-2022-38400
Published: 2022-09-08
Description: Mailform Pro CGI 4.3.1 and earlier allow a remote unauthenticated attacker to obtain the user input data by having a use of the product to access a specially crafted URL.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-200
References: https://jvn.jp/en/jp/JVN34205166/index.html; https://www.synck.com/blogs/news/newsroom/detail_[PII_REDACTED].html; https://www.synck.com/downloads/cgi-perl/mailformpro/feature_[PII_REDACTED].html
CVE: CVE-2022-3138
Published: 2022-09-08
Description: Cross-site Scripting (XSS) - Generic in GitHub repository jgraph/drawio prior to 20.3.0.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/jgraph/drawio/commit/b5dfeb238369d664fb06a95e2179236b0e75f366; https://huntr.dev/bounties/1816a207-6abf-408c-b19a-e497e24172b3; https://github.com/jgraph/drawio/commit/b5dfeb238369d664fb06a95e2179236b0e75f366
CVE: CVE-2022-3148
Published: 2022-09-08
Description: Cross-site Scripting (XSS) - Generic in GitHub repository jgraph/drawio prior to 20.3.0.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/jgraph/drawio/commit/b5dfeb238369d664fb06a95e2179236b0e75f366; https://huntr.dev/bounties/1f730015-b4d0-4f84-8cac-9cf1e57a091a; https://github.com/jgraph/drawio/commit/b5dfeb238369d664fb06a95e2179236b0e75f366
CVE: CVE-2022-27593
Published: 2022-09-08
Description: An externally controlled reference to a resource vulnerability has been reported to affect QNAP NAS running Photo Station. If exploited, This could allow an attacker to modify system files. We have already fixed the vulnerability in the following versions: QTS 5.0.1: Photo Station 6.1.2 and later QTS 5.0.0/4.5.x: Photo Station 6.0.22 and later QTS 4.3.6: Photo Station 5.7.18 and later QTS 4.3.3: Photo Station 5.4.15 and later QTS 4.2.6: Photo Station 5.2.14 and later
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-610, CWE-610
References: https://www.qnap.com/en/security-advisory/qsa-22-24; https://www.qnap.com/en/security-advisory/qsa-22-24; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-27593
CVE: CVE-2022-30079
Published: 2022-09-08
Description: Command injection vulnerability was discovered in Netgear R6200 v2 firmware through R6200v2-V1.0.3.12 via binary /sbin/acos_service that could allow remote authenticated attackers the ability to modify values in the vulnerable parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://netgear.com; http://r6200v2.com; https://github.com/10TG/vulnerabilities/blob/main/Netgear/CVE-2022-30079/CVE-2022-30079.md
CVE: CVE-2022-20696
Published: 2022-09-08
Description: A vulnerability in the binding configuration of Cisco SD-WAN vManage Software containers could allow an unauthenticated, adjacent attacker who has access to the VPN0 logical network to also access the messaging service ports on an affected system. This vulnerability exists because the messaging server container ports on an affected system lack sufficient protection mechanisms. An attacker could exploit this vulnerability by connecting to the messaging service ports of the affected system. To exploit this vulnerability, the attacker must be able to send network traffic to interfaces within the VPN0 logical network. This network may be restricted to protect logical or physical adjacent networks, depending on device deployment configuration. A successful exploit could allow the attacker to view and inject messages into the messaging service, which can cause configuration changes or cause the system to reload.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vmanage-msg-serv-AqTup7vs; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vmanage-msg-serv-AqTup7vs
CVE: CVE-2022-20863
Published: 2022-09-08
Description: A vulnerability in the messaging interface of Cisco Webex App, formerly Webex Teams, could allow an unauthenticated, remote attacker to manipulate links or other content within the messaging interface. This vulnerability exists because the affected software does not properly handle character rendering. An attacker could exploit this vulnerability by sending messages within the application interface. A successful exploit could allow the attacker to modify the display of links or other content within the interface, potentially allowing the attacker to conduct phishing or spoofing attacks.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-450
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-app-qrtO6YC2; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-app-qrtO6YC2
CVE: CVE-2022-20923
Published: 2022-09-08
Description: A vulnerability in the IPSec VPN Server authentication functionality of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an unauthenticated, remote attacker to bypass authentication controls and access the IPSec VPN network. This vulnerability is due to the improper implementation of the password validation algorithm. An attacker could exploit this vulnerability by logging in to the VPN from an affected device with crafted credentials. A successful exploit could allow the attacker to bypass authentication and access the IPSec VPN network. The attacker may obtain privileges that are the same level as an administrative user, depending on the crafted credentials that are used. Cisco has not released software updates that address this vulnerability.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-303, CWE-287
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sb-rv-vpnbypass-Cpheup9O; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sb-rv-vpnbypass-Cpheup9O
CVE: CVE-2022-36736
Published: 2022-09-08
Description: Jitsi-2.10.5550 was discovered to contain a vulnerability in its web UI which allows attackers to perform a clickjacking attack via a crafted HTTP request. NOTE: this is disputed by the vendor
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-1021
References: https://github.com/UditChavda/Udit-Chavda-CVE/blob/main/CVE-2022-36736; https://meet.jit.si/; https://github.com/UditChavda/Udit-Chavda-CVE/blob/main/CVE-2022-36736
CVE: CVE-2022-36085
Published: 2022-09-08
Description: Open Policy Agent (OPA) is an open source, general-purpose policy engine. The Rego compiler provides a (deprecated) `WithUnsafeBuiltins` function, which allows users to provide a set of built-in functions that should be deemed unsafe — and as such rejected — by the compiler if encountered in the policy compilation stage. A bypass of this protection has been found, where the use of the `with` keyword to mock such a built-in function (a feature introduced in OPA v0.40.0), isn’t taken into account by `WithUnsafeBuiltins`. Multiple conditions need to be met in order to create an adverse effect. Version 0.43.1 contains a patch for this issue. As a workaround, avoid using the `WithUnsafeBuiltins` function and use the `capabilities` feature instead.
CVSS Score: 7.4 (HIGH)
CWE: CWE-20, CWE-693
References: https://github.com/open-policy-agent/opa/commit/25a597bc3f4985162e7f65f9c36599f4f8f55823; https://github.com/open-policy-agent/opa/commit/3e8c754ed007b22393cf65e48751ad9f6457fee8; https://github.com/open-policy-agent/opa/pull/4540
CVE: CVE-2022-36090
Published: 2022-09-08
Description: XWiki Platform Old Core is a core package for XWiki Platform, a generic wiki platform. Prior to versions 13.1.0.5 and 14.3-rc-1, some resources are missing a check for inactive (not yet activated or disabled) users in XWiki, including the REST service. This means a disabled user can enable themselves using a REST call. On the same way some resources handler created by extensions are not protected by default, so an inactive user could perform actions for such extensions. This issue has existed since at least version 1.1 of XWiki for instance configured with the email activation required for new users. Now it's more critical for versions 11.3-rc-1 and later since the maintainers provided the capability to disable user without deleting them and encouraged using that feature. XWiki 14.3-rc-1 and XWiki 13.10.5 contain a patch. There is no workaround for this other than upgrading XWiki.
CVSS Score: 8.1 (HIGH)
CWE: CWE-285
References: https://github.com/xwiki/xwiki-platform/commit/e074d226d9b2b96a0a1ba4349d1b73a802842986; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-jgc8-gvcx-9vfx; https://jira.xwiki.org/browse/XWIKI-19559
CVE: CVE-2022-3153
Published: 2022-09-08
Description: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0404.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/vim/vim/commit/1540d334a04d874c2aa9d26b82dbbcd4bc5a78de; https://huntr.dev/bounties/68331124-620d-48bc-a8fa-cd947b26270a; https://security.gentoo.org/glsa/202305-16
CVE: CVE-2022-22314
Published: 2022-09-08
Description: IBM Planning Analytics Local 2.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 217371.
CVSS Score: 3.3 (LOW)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/217371; https://www.ibm.com/support/pages/node/6615289; https://exchange.xforce.ibmcloud.com/vulnerabilities/217371
CVE: CVE-2022-27967
Published: 2022-09-08
Description: Cynet 360 Web Portal before v4.5 was discovered to allow attackers to access a list of excluded files and profiles via a crafted GET request sent to /WebApp/SettingsExclusion/GetExclusionsProfiles.
CVSS Score: 5.3 (MEDIUM)
References: https://www.cynet.com/platform/; https://www.srlabs.de/bites/edr-security; https://www.cynet.com/platform/
CVE: CVE-2022-27968
Published: 2022-09-08
Description: Cynet 360 Web Portal before v4.5 was discovered to allow attackers to access a list of monitored files and profiles via a crafted GET request sent to /WebApp/SettingsFileMonitor/GetFileMonitorProfiles.
CVSS Score: 5.3 (MEDIUM)
References: https://www.cynet.com/platform/; https://www.srlabs.de/bites/edr-security; https://www.cynet.com/platform/
CVE: CVE-2022-27969
Published: 2022-09-08
Description: Cynet 360 Web Portal before v4.5 was discovered to allow attackers to access a list of decoy users via a crafted GET request sent to /WebApp/DeceptionUser/GetAllDeceptionUsers.
CVSS Score: 5.3 (MEDIUM)
References: https://www.cynet.com/platform/; https://www.srlabs.de/bites/edr-security; https://www.cynet.com/platform/
CVE: CVE-2022-36091
Published: 2022-09-08
Description: XWiki Platform Web Templates are templates for XWiki Platform, a generic wiki platform. Through the suggestion feature, string and list properties of objects the user shouldn't have access to can be accessed in versions prior to 13.10.4 and 14.2. This includes private personal information like email addresses and salted password hashes of registered users but also other information stored in properties of objects. Sensitive configuration fields like passwords for LDAP or SMTP servers could be accessed. By exploiting an additional vulnerability, this issue can even be exploited on private wikis at least for string properties. The issue is patched in version 13.10.4 and 14.2. Password properties are no longer displayed and rights are checked for other properties. A workaround is available. The template file `suggest.vm` can be replaced by a patched version without upgrading or restarting XWiki unless it has been overridden, in which case the overridden template should be patched, too. This might need adjustments for older versions, though.
CVSS Score: 7.5 (HIGH)
CWE: CWE-359, CWE-862, CWE-862
References: https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-599v-w48h-rjrm; https://jira.xwiki.org/browse/XWIKI-18849; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-599v-w48h-rjrm