Insertion of Sensitive Information Into Sent Data Affecting org.xwiki.platform:xwiki-platform-security-authentication-default package, versions [11.10.1,14.10.15)[15.0.0,15.5.1)[15.6-rc-1,15.6)


Severity

Recommended
0.0
critical
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Threat Intelligence

Exploit Maturity
Proof of concept
EPSS
0.14% (51st percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-JAVA-ORGXWIKIPLATFORM-6069937
  • published21 Nov 2023
  • disclosed20 Nov 2023
  • creditMichael Hamann

Introduced: 20 Nov 2023

CVE-2023-48240  (opens in a new tab)
CWE-201  (opens in a new tab)

How to fix?

Upgrade org.xwiki.platform:xwiki-platform-security-authentication-default to version 14.10.15, 15.5.1, 15.6 or higher.

Overview

Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data through the use of the rendered diff feature. An attacker is capable of hijacking login and session cookies by linking the rendered diff with an image, thus impersonating the user who views the diff.

Note:

Exploiting this vulnerability opens the door to server-side request forgery and accessing restricted content, because once a resource is cached, it becomes accessible to all users.

Workaround

The image embedding feature can be disabled by deleting xwiki-platform-diff-xml-.jar in WEB-INF/lib/.

CVSS Scores

version 3.1