CVE-2007-4888: Low severity XWiki xwiki vulnerability

Published Sep 14, 2007

Updated

The "You are not allowed..." error handler in XWiki 1.0 B1 and 1.0 B2 associates the doc variable with the entire document content and metadata regardless of a user's view rights, which allows remote authenticated users to read arbitrary documents via a custom skin that prints the content attribute of the doc variable.

Affected Software

2 affected components

XWiki xwiki=1.0_b2

XWiki xwiki=1.0_b1

Event History

Sep 14, 2007

CVE Published

12:17 AM

CVE Published

via MITRE·04:00 AM

Data Sourced

via MITRE·04:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2007-4888?

CVE-2007-4888 has a medium severity rating due to the potential exposure of sensitive document content to unauthorized users.

How do I fix CVE-2007-4888?

To fix CVE-2007-4888, upgrade to a later version of XWiki that patches the authorization flaw.

What versions of XWiki are affected by CVE-2007-4888?

CVE-2007-4888 affects XWiki versions 1.0 B1 and 1.0 B2.

Can CVE-2007-4888 be exploited remotely?

Yes, CVE-2007-4888 can be exploited by remote authenticated users to view restricted documents.

What does CVE-2007-4888 affect in XWiki?

CVE-2007-4888 affects the error handling mechanism, allowing unauthorized access to document content based on user privileges.