CVE-2023-29208

HIGH

XWiki < 13.10.11 - Unauthorized Deleted Document Access

Title source: llm
STIX 2.1

Description

XWiki Commons are technical libraries common to several other top level XWiki projects. Rights added to a document are not taken into account for viewing it once it's deleted. Note that this vulnerability only impact deleted documents that where containing view rights: the view rights provided on a space of a deleted document are properly checked. The problem has been patched in XWiki 14.10 by checking the rights of current user: only admin and deleter of the document are allowed to view it.

References (3)

Core 3

Scores

CVSS v3 7.5
EPSS 0.0092
EPSS Percentile 55.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-668
Status published
Products (2)
org.xwiki.platform/xwiki-platform-oldcore 1.2-milestone-1 - 13.10.11Maven
xwiki/xwiki 1.1 - 13.10.11
Published Apr 15, 2023
Tracked Since Feb 18, 2026