-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from missing authorization checks in REST API handlers for page history endpoints. The commit diffs show both functions were modified to add ContextualAuthorizationManager checks for VIEW rights, which were absent in vulnerable versions. The JIRA ticket XWIKI-22052 explicitly identifies these endpoints as problematic, and the CWE-862 (Missing Authorization) classification confirms the lack of permission validation in these functions. Unit tests added in the commit verify authorization enforcement, further confirming these were the vulnerable entry points.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.xwiki.platform:xwiki-platform-rest-server | maven | >= 1.8.0, < 15.10.9 | 15.10.9 |
| org.xwiki.platform:xwiki-platform-rest-server | maven | >= 16.0.0-rc-1, < 16.3.0-rc-1 | 16.3.0-rc-1 |
JavaJavaKEV Misses 88% of Exploited CVEs- Get the report