CVE-2023-29208: Data leak through deleted documents
XWiki Commons are technical libraries common to several other top level XWiki projects. Rights added to a document are not taken into account for viewing it once it's deleted. Note that this vulnerability only impact deleted documents that where containing view rights: the view rights provided on a space of a deleted document are properly checked. The problem has been patched in XWiki 14.10 by checking the rights of current user: only admin and deleter of the document are allowed to view it.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-29208?
CVE-2023-29208 has a moderate severity due to its impact on the handling of view rights for deleted documents.
How do I fix CVE-2023-29208?
To fix CVE-2023-29208, update your XWiki installation to a version that includes the patch addressing this vulnerability.
What versions of XWiki are affected by CVE-2023-29208?
CVE-2023-29208 affects XWiki versions from 1.1 to 13.10.11, and versions from 14.4.0 to 14.4.7, as well as 14.5 to 14.10.
What are the consequences of CVE-2023-29208?
The consequence of CVE-2023-29208 is that deleted documents with view rights may still be accessible, posing a potential information disclosure risk.
Who is impacted by CVE-2023-29208?
Users of XWiki versions affected by CVE-2023-29208 are impacted, especially those managing access to documents in their XWiki environments.