CVE-2023-34466
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
The XWiki Platform has a vulnerability that allows tags from pages not viewable to the current user to be leaked via the tags API. This information can be exploited to infer the document reference of non-viewable pages.
Risk Assessment
The disclosure of information about inaccessible pages may lead to privacy breaches and data security issues within the organization. An attacker could use this data for further malicious actions.
Recommendation
It is recommended to upgrade to XWiki versions 14.4.8, 14.10.4, or 15.0-rc-1 to mitigate this vulnerability. A data access audit should also be conducted to minimize risk.
Original NVD description (English source)
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 5.0-milestone-1 and prior to versions 14.4.8, 14.10.4, and 15.0-rc-1, tags from pages not viewable to the current user are leaked by the tags API. This information can also be exploited to infer the document reference of non-viewable pages. This vulnerability has been patched in XWiki 14.4.8, 14.10.4, and 15.0-rc-1.