CVE-2022-24820

MEDIUM

XWiki Platform < 12.10.11 - Unauthenticated Exposure of Private Personal Information via Velocity Document Rendering

Title source: llm
STIX 2.1

Description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A guest user without the right to view pages of the wiki can still list documents by rendering some velocity documents. The problem has been patched in XWiki versions 12.10.11, 13.4.4, and 13.9-rc-1. There is no known workaround for this problem.

References (2)

Core 2
Core References
Exploit, Issue Tracking, Third Party Advisory x_refsource_misc
https://jira.xwiki.org/browse/XWIKI-16544

Scores

CVSS v3 5.3
EPSS 0.0097
EPSS Percentile 57.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact partial

Details

CWE
CWE-359 CWE-306
Status published
Products (3)
org.xwiki.platform/xwiki-platform-web 0 - 12.10.11Maven
xwiki/xwiki 13.9
xwiki/xwiki < 12.10.11
Published Apr 08, 2022
Tracked Since Feb 18, 2026