medium5.3
CVE-2022-24820
Unauthenticated user can list hidden document from multiple velocity templates in XWiki
Impact
### Impact A guest user without the right to view pages of the wiki can still list documents by rendering some velocity documents. ### Patches The problem has been patched in XWiki versions 12.10.11, 13.4.4, and 13.9-rc-1. ### Workarounds There is no known workaround for this problem. ### References https://jira.xwiki.org/browse/XWIKI-16544 ### For more information If you have any questions or comments about this advisory: * Open an issue in [Jira XWiki](https://jira.xwiki.org) * Email us at [our security mailing list](mailto:security@xwiki.org)
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.xwiki.platform:xwiki-platform-web | < 12.10.11 | 12.10.11 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Xwiki | Xwiki | before 12.10.11 from 13.4.0 before 13.4.4 Version 13.9 |