From 97ecde4baa1df84de16b1963e440025394ae29ec Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Wed, 19 Mar 2025 20:36:19 +0000 Subject: [PATCH] Publish Advisories GHSA-22q5-9phm-744v GHSA-gfp2-6qhm-7x43 --- .../GHSA-22q5-9phm-744v.json | 115 ++++++++++++++++++ .../GHSA-gfp2-6qhm-7x43.json | 107 ++++++++++++++++ 2 files changed, 222 insertions(+) create mode 100644 advisories/github-reviewed/2025/03/GHSA-22q5-9phm-744v/GHSA-22q5-9phm-744v.json create mode 100644 advisories/github-reviewed/2025/03/GHSA-gfp2-6qhm-7x43/GHSA-gfp2-6qhm-7x43.json diff --git a/advisories/github-reviewed/2025/03/GHSA-22q5-9phm-744v/GHSA-22q5-9phm-744v.json b/advisories/github-reviewed/2025/03/GHSA-22q5-9phm-744v/GHSA-22q5-9phm-744v.json new file mode 100644 index 00000000000..1c4b5f979d1 --- /dev/null +++ b/advisories/github-reviewed/2025/03/GHSA-22q5-9phm-744v/GHSA-22q5-9phm-744v.json @@ -0,0 +1,115 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-22q5-9phm-744v", + "modified": "2025-03-19T20:34:43Z", + "published": "2025-03-19T20:34:43Z", + "aliases": [ + "CVE-2025-29925" + ], + "summary": "XWiki allows unregistered users to access private pages information through REST endpoint", + "details": "### Impact\n\nProtected pages are listed when requesting the REST endpoints `/rest/wikis/[wikiName]/pages` even if the user doesn't have view rights on them. \nIt's particularly true if the entire wiki is protected with \"Prevent unregistered user to view pages\": the endpoint would still list the pages of the wiki (actually it only impacts the main wiki due to XWIKI-22639).\n\n### Patches\n\nThe problem has been patched in XWiki 15.10.14, 16.4.6, 16.10.0RC1. In those versions the endpoint can still be requested but the result is filtered out based on pages rights.\n\n### Workarounds\n\nThere's no workaround except upgrading or applying manually the changes of the commits (see references) in `xwiki-platform-rest-server` and recompiling / rebuilding it.\n\n### References\n\n * Original JIRA ticket: https://jira.xwiki.org/browse/XWIKI-22630\n * Related JIRA ticket: https://jira.xwiki.org/browse/XWIKI-22639\n * Commits of the patch: https://github.com/xwiki/xwiki-platform/commit/bca72f5ce971a31dba2a016d8dd8badda4475206 and https://github.com/xwiki/xwiki-platform/commit/1fb12d2780f37b34a1b4dfdf8457d97ce5cbb2df\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)\n* Email us at [Security Mailing List](mailto:security@xwiki.org)", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.xwiki.platform:xwiki-platform-rest-server" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.9M1" + }, + { + "fixed": "15.10.14" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.xwiki.platform:xwiki-platform-rest-server" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "16.0.0-rc-1" + }, + { + "fixed": "16.4.6" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.xwiki.platform:xwiki-platform-rest-server" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "16.5.0-rc-1" + }, + { + "fixed": "16.10.0-rc-1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-22q5-9phm-744v" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-29925" + }, + { + "type": "WEB", + "url": "https://github.com/xwiki/xwiki-platform/commit/1fb12d2780f37b34a1b4dfdf8457d97ce5cbb2df" + }, + { + "type": "WEB", + "url": "https://github.com/xwiki/xwiki-platform/commit/bca72f5ce971a31dba2a016d8dd8badda4475206" + }, + { + "type": "PACKAGE", + "url": "https://github.com/xwiki/xwiki-platform" + }, + { + "type": "WEB", + "url": "https://jira.xwiki.org/browse/XWIKI-22630" + }, + { + "type": "WEB", + "url": "https://jira.xwiki.org/browse/XWIKI-22639" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-402" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2025-03-19T20:34:43Z", + "nvd_published_at": "2025-03-19T18:15:25Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/03/GHSA-gfp2-6qhm-7x43/GHSA-gfp2-6qhm-7x43.json b/advisories/github-reviewed/2025/03/GHSA-gfp2-6qhm-7x43/GHSA-gfp2-6qhm-7x43.json new file mode 100644 index 00000000000..d61585d0bad --- /dev/null +++ b/advisories/github-reviewed/2025/03/GHSA-gfp2-6qhm-7x43/GHSA-gfp2-6qhm-7x43.json @@ -0,0 +1,107 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-gfp2-6qhm-7x43", + "modified": "2025-03-19T20:34:56Z", + "published": "2025-03-19T20:34:55Z", + "aliases": [ + "CVE-2025-29926" + ], + "summary": "The WikiManager REST API allows any user to create wikis", + "details": "### Impact\n\nAny user can exploit the WikiManager REST API to create a new wiki, where the user could become an administrator and so performs other attacks on the farm.\nNote that this REST API is not bundled in XWiki Standard by default: it needs to be installed manually through the extension manager.\n\n### Patches\n\nThe problem has been patched in versions 15.10.15, 16.4.6 and 16.10.0 of the REST module.\n\n### Workarounds\n\nThere's no workaround other than upgrading the dependency.\n\n### References\n\n * JIRA ticket: https://jira.xwiki.org/browse/XWIKI-22490\n * Commit of the fix: https://github.com/xwiki/xwiki-platform/commit/82aa670106c7f5e6238ca6ed59a52d1800e05b99\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)\n* Email us at [Security Mailing List](mailto:security@xwiki.org)\n\n### Attribution\n\nYou can specify here who reported the issue.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.xwiki.platform:xwiki-platform-wiki-rest-default" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "5.4-rc-1" + }, + { + "fixed": "15.10.15" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.xwiki.platform:xwiki-platform-wiki-rest-default" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "16.0.0-rc-1" + }, + { + "fixed": "16.4.6" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.xwiki.platform:xwiki-platform-wiki-rest-default" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "16.5.0-rc-1" + }, + { + "fixed": "16.10.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-gfp2-6qhm-7x43" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-29926" + }, + { + "type": "WEB", + "url": "https://github.com/xwiki/xwiki-platform/commit/82aa670106c7f5e6238ca6ed59a52d1800e05b99" + }, + { + "type": "PACKAGE", + "url": "https://github.com/xwiki/xwiki-platform" + }, + { + "type": "WEB", + "url": "https://jira.xwiki.org/browse/XWIKI-22490" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-285" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2025-03-19T20:34:55Z", + "nvd_published_at": "2025-03-19T18:15:25Z" + } +} \ No newline at end of file