CVE-2022-29253: Path Traversal in XWiki Platform
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting with version 8.3-rc-1 and prior to versions 12.10.3 and 14.0, one can ask for any file located in the classloader using the template API and a path with ".." in it. The issue is patched in versions 14.0 and 13.10.3. There is no easy workaround for this issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-29253?
CVE-2022-29253 is rated as a high severity vulnerability due to its potential for unauthorized file access.
How do I fix CVE-2022-29253?
To fix CVE-2022-29253, upgrade to XWiki version 12.10.3 or 14.0 or later.
What types of systems are affected by CVE-2022-29253?
CVE-2022-29253 affects all XWiki Platform versions from 8.4 to 13.10.3, including 8.3-rc-1.
What attack vector is associated with CVE-2022-29253?
The attack vector for CVE-2022-29253 involves exploiting the template API to traverse directories and access restricted files.
Is user authentication a factor in CVE-2022-29253?
No, CVE-2022-29253 can be exploited without user authentication, making it particularly dangerous.