Miggo Logo
Miggo Vulnerability Database
→
CVE-2023-37911

CVE-2023-37911: org.xwiki.platform:xwiki-platform-oldcore may leak data through deleted and re-created documents

6.5

CVSS Score
3.1

Basic Information

CVE ID
CVE-2023-37911
GHSA ID
GHSA-gh64-qxh5-4m33
EPSS Score
0.55906%
CWE
CWE-668
Published
10/25/2023
Updated
11/10/2023
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
org.xwiki.platform:xwiki-platform-oldcoremaven>= 9.4-rc-1, < 14.10.814.10.8
org.xwiki.platform:xwiki-platform-oldcoremaven>= 15.0-rc-1, < 15.3-rc-115.3-rc-1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from missing access checks when retrieving deleted document revisions. The patches in the commit f471f2a explicitly add authorization checks (via checkAccess) in both Document.getDocumentRevision and XWiki.getDocument. These functions previously relied only on general view rights for the document reference, not accounting for deleted revisions. The added checks for Right.VIEW on the specific revision (including deleted ones) confirm that these were the vulnerable entry points. The exploit via the diff feature and REST API directly maps to these functions' behavior before the patch.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t W**n * *o*um*nt **s ***n **l*t** *n* r*-*r**t**, it is possi*l* *or us*rs wit* vi*w ri**t on t** r*-*r**t** *o*um*nt *ut not on t** **l*t** *o*um*nt to vi*w t** *ont*nts o* t** **l*t** *o*um*nt. Su** * situ*tion mi**t *ris* w**n ri**ts w*

Reasoning

T** vuln*r**ility st*ms *rom missin* ****ss ****ks w**n r*tri*vin* **l*t** *o*um*nt r*visions. T** p*t***s in t** *ommit `*******` *xpli*itly *** *ut*oriz*tion ****ks (vi* `****k****ss`) in *ot* `*o*um*nt.**t*o*um*ntR*vision` *n* `XWiki.**t*o*um*nt`.