-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from missing authorization checks in the attachment move operation. The critical commit added a new checkMoveRights() method to validate() permissions, which was absent in the original code. The vulnerable process() method directly performed destructive operations (move + event notifications) without these checks. The test file modifications further confirm this by adding authorization failure test cases that would have been impossible to pass before the patch. The function's pre-patch behavior matches the CWE-862 description of missing authorization gates before performing sensitive actions.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.xwiki.platform:xwiki-platform-attachment-api | maven | >= 14.0-rc-1, < 14.4.8 | 14.4.8 |
| org.xwiki.platform:xwiki-platform-attachment-api | maven | >= 14.5, < 14.10.4 | 14.10.4 |
JavaJava