XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users without the right to view documents can deduce their existence by repeated Livetable queries. The issue has been patched in XWiki 14.6RC1, 13.10.8, and 14.4.3, the response is not properly cleaned up of obfuscated entries. As a workaround, The patch for the document `XWiki.LiveTableResultsMacros` can be manually applied or a XAR archive of a patched version can be imported, on versions 12.10.11, 13.9-rc-1, and 13.4.4. There are no known workarounds for this issue.

Threat-Mapped Scoring

Score: 0.0

Priority: Unclassified

EPSS

Score: 0.00233
Percentile: 0.46147

CVSS Scoring

Mapped CWE(s)

• CWE-200 : Exposure of Sensitive Information to an Unauthorized Actor

All CAPEC(s)

CAPEC(s) with Mapped TTPs

Mapped ATT&CK TTPs

• T1562.003 : Impair Command History Logging
  Kill Chain: defense-evasion
• T1574.006 : Dynamic Linker Hijacking
  Kill Chain: persistence
• T1574.007 : Path Interception by PATH Environment Variable
  Kill Chain: persistence
• T1217 : Browser Information Discovery
  Kill Chain: discovery
• T1592 : Gather Victim Host Information
  Kill Chain: reconnaissance
• T1595 : Active Scanning
  Kill Chain: reconnaissance
• T1018 : Remote System Discovery
  Kill Chain: discovery
• T1124 : System Time Discovery
  Kill Chain: discovery
• T1046 : Network Service Discovery
  Kill Chain: discovery
• T1016 : System Network Configuration Discovery
  Kill Chain: discovery
• T1049 : System Network Connections Discovery
  Kill Chain: discovery
• T1590 : Gather Victim Network Information
  Kill Chain: reconnaissance
• T1082 : System Information Discovery
  Kill Chain: discovery
• T1082 : System Information Discovery
  Kill Chain: discovery
• T1083 : File and Directory Discovery
  Kill Chain: discovery
• T1057 : Process Discovery
  Kill Chain: discovery
• T1007 : System Service Discovery
  Kill Chain: discovery
• T1087 : Account Discovery
  Kill Chain: discovery
• T1069 : Permission Groups Discovery
  Kill Chain: discovery
• T1615 : Group Policy Discovery
  Kill Chain: discovery
• T1033 : System Owner/User Discovery
  Kill Chain: discovery
• T1134.001 : Token Impersonation/Theft
  Kill Chain: defense-evasion
• T1550.004 : Web Session Cookie
  Kill Chain: defense-evasion
• T1036.005 : Match Legitimate Resource Name or Location
  Kill Chain: defense-evasion
• T1135 : Network Share Discovery
  Kill Chain: discovery
• T1120 : Peripheral Device Discovery
  Kill Chain: discovery
• T1111 : Multi-Factor Authentication Interception
  Kill Chain: credential-access

Malware

APTs Threat Group Associations

Campaigns

Affected Products

• cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*
• cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*
• cpe:2.3:a:xwiki:xwiki:14.4.4:*:*:*:*:*:*:*
• cpe:2.3:a:xwiki:xwiki:14.4.5:*:*:*:*:*:*:*

← Back to Home