-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.xwiki.platform:xwiki-platform-oldcore | maven | >= 9.4-rc-1, < 14.10.8 | 14.10.8 |
| org.xwiki.platform:xwiki-platform-oldcore | maven | >= 15.0-rc-1, < 15.3-rc-1 | 15.3-rc-1 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from missing access checks when retrieving deleted document revisions. The patches in the commit f471f2a explicitly add authorization checks (via checkAccess) in both Document.getDocumentRevision and XWiki.getDocument. These functions previously relied only on general view rights for the document reference, not accounting for deleted revisions. The added checks for Right.VIEW on the specific revision (including deleted ones) confirm that these were the vulnerable entry points. The exploit via the diff feature and REST API directly maps to these functions' behavior before the patch.
A Semantic Attack on Google Gemini - Read the Latest Research