Detections
Analytics
SCA: security update for org.xwiki.platform:xwiki-platform-search-solr-query (GHSA-7fqr-97j7-jgf4)
high Tenable Cloud Security Plugin ID 412037
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- XWiki Platform is a generic wiki platform. Starting in version 6.3-milestone-2 and prior to versions
14.10.15, 15.5.1, and 15.6RC1, the Solr-based search suggestion provider that also duplicates as generic
JavaScript API for search results in XWiki exposes the content of all documents of all wikis to anybody
who has access to it, by default it is public. This exposes all information stored in the wiki (but not
some protected information like password hashes). While there is a right check normally, the right check
can be circumvented by explicitly requesting fields from Solr that don't include the data for the right
check. This has been fixed in XWiki 15.6RC1, 15.5.1 and 14.10.15 by not listing documents whose rights
cannot be checked. No known workarounds are available. (CVE-2023-48241)
See Also
Plugin Details
Severity: High
ID: 412037
Version: Revision 1.4
Type: Local
Family: SCA Checks
Published: 1/23/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 3
Percentile: 23.51
Vendor
Vendor Severity: High
CVSS v2
Risk Factor: High
Base Score: 7.8
Temporal Score: 5.8
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N
CVSS Score Source: CVE-2023-48241
CVSS v3
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 11/20/2023
Vulnerability Publication Date: 11/20/2023
Reference Information
CVE: CVE-2023-48241
cwe: CWE-285