{"id":"CVE-2023-29208","published":"2023-04-15T15:52:47Z","modified":"2025-02-06T17:08:49Z","title":"Data leak through deleted documents","vendor":"xwiki","product":"xwiki-platform","tier":"tail","description":{"text":"XWiki Commons are technical libraries common to several other top level XWiki projects. Rights added to a document are not taken into account for viewing it once it's deleted. Note that this vulnerability only impact deleted documents that where containing view rights: the view rights provided on a space of a deleted document are properly checked. The problem has been patched in XWiki 14.10 by checking the rights of current user: only admin and deleter of the document are allowed to view it.","provenance":"source","from":"CVE.org"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00929,"percentile":0.60578,"provenance":"source"},"cwes":[{"id":"CWE-668","name":"Exposure of Resource to Wrong Sphere"}],"references":[{"url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-4f8g-fq6x-jqrr","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/xwiki/xwiki-platform/commit/d9e947559077e947315bf700c5703dfc7dd8a8d7","tags":["x_refsource_MISC"]},{"url":"https://jira.xwiki.org/browse/XWIKI-16285","tags":["x_refsource_MISC"]}],"priority":{"score":17.4,"factors":[{"name":"EPSS percentile","points":12.12},{"name":"CVSS severity","points":5.25}]},"vendorSlug":"xwiki","affectedVersions":[{"vendor":"xwiki","product":"xwiki-platform","versions":[">= 1.2-milestone-1, < 13.10.11",">= 14.0-rc-1, < 14.4.7",">= 14.5, < 14.10"]}],"affected":[{"ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-oldcore","vulnerableRanges":[">=1.2-milestone-1, <13.10.11",">=14.0-rc-1, <14.4.7",">=14.5, <14.10"],"patched":["13.10.11","14.4.7","14.10"],"from":["GHSA-4f8g-fq6x-jqrr"],"provenance":"source"}],"euvd":{"id":"EUVD-2023-1188","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2022-41932","published":"2022-11-23","fixed":"14.6-rc-1","kev":false},{"cve":"CVE-2023-29204","published":"2023-04-15","fixed":"14.8-rc-1","kev":false,"link":{"from":"CVE-2023-29204","to":"CVE-2023-29208","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.xwiki.platform:xwiki-platform-oldcore","fromFixed":"14.4.4","toFixed":"14.4.7","daysApart":0}]}},{"cve":"CVE-2023-26474","published":"2023-03-02","fixed":"14.10","kev":false},{"cve":"CVE-2023-29208","published":"2023-04-15","fixed":"14.10","kev":false},{"cve":"CVE-2023-29507","published":"2023-04-16","fixed":"14.10","kev":false},{"cve":"CVE-2023-29523","published":"2023-04-18","fixed":"14.10.2","kev":false},{"cve":"CVE-2023-29526","published":"2023-04-18","fixed":"14.10.3","kev":false}],"package":"Maven:org.xwiki.platform:xwiki-platform-oldcore"}}