-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from the suggest.vm template handling data exposure without authorization checks. Multiple sources explicitly mention suggest.vm as the component requiring patching/workarounds. The template's role in processing suggestion requests aligns with the described attack vector (xpage=suggest parameter in URLs). The patch notes specifically mention adding rights checks and removing password display - operations that would be implemented in the template rendering logic. While no specific Java functions are named, the Velocity template's data rendering logic is the clear vulnerable component given the context of web template vulnerabilities and the workaround instructions.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.xwiki.platform:xwiki-platform-web-templates | maven | >= 1.3, < 13.10.4 | 13.10.4 |
| org.xwiki.platform:xwiki-platform-web | maven | >= 14.0, < 14.2 | 14.2 |