What is GHSA-8692-g6g9-gm5p?

GHSA-8692-g6g9-gm5p is a security advisory published by GitHub Security Advisories with Medium severity. xwiki contains Exposed Dangerous Method or Function

Which CVE IDs does GHSA-8692-g6g9-gm5p cover?

GHSA-8692-g6g9-gm5p covers the following CVE IDs: CVE-2023-26478. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-8692-g6g9-gm5p?

GHSA-8692-g6g9-gm5p has a CVSS v3 base score of 6.6, published by GitHub Security Advisories.

Which products are affected by GHSA-8692-g6g9-gm5p?

GHSA-8692-g6g9-gm5p affects 2 products, including: maven/org.xwiki.platform:xwiki-platform-store-filesystem-oldcore:\u003e= 14.3-rc-1, \u003c 14.4.6; maven/org.xwiki.platform:xwiki-platform-store-filesystem-oldcore:\u003e= 14.5, \u003c 14.9-rc-1.

GHSA-8692-g6g9-gm5pMediumCVSS 6.6

xwiki contains Exposed Dangerous Method or Function

Vendor

GitHub Security Advisories

Published

March 3, 2023

Last Modified

March 3, 2023

🔗 CVE IDs covered (1)

CVE-2023-26478 →

📋 Description

Impact

org.xwiki.store.script.TemporaryAttachmentsScriptService#uploadTemporaryAttachment is returning an instance of com.xpn.xwiki.doc.XWikiAttachment. This class is not supported to be exposed to users without the programing right. com.xpn.xwiki.api.Attachment should be used instead and takes case of checking the user's rights before performing dangerous operations.

Patches

This has been patched in the version 14.9-rc-1 and 14.4.6.

Workarounds

There's no workaround for this issue.

References

https://jira.xwiki.org/browse/XWIKI-20180

For more information

If you have any questions or comments about this advisory:

Open an issue in JIRA
Email us at security ML

🎯 Affected products2

maven/org.xwiki.platform:xwiki-platform-store-filesystem-oldcore:>= 14.3-rc-1, < 14.4.6
maven/org.xwiki.platform:xwiki-platform-store-filesystem-oldcore:>= 14.5, < 14.9-rc-1