Detections
Analytics
SCA: security update for org.xwiki.platform:xwiki-platform-attachment-api (GHSA-rwwx-6572-mp29)
high Tenable Cloud Security Plugin ID 418977
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it.
Starting with the introduction of attachment move support in version 14.0-rc-1 and prior to versions
14.4.8, 14.10.4, and 15.0-rc-1, an attacker with edit access on any document (can be the user profile
which is editable by default) can move any attachment of any other document to this attacker-controlled
document. This allows the attacker to access and possibly publish any attachment of which the name is
known, regardless if the attacker has view or edit rights on the source document of this attachment.
Further, the attachment is deleted from the source document. This vulnerability has been patched in XWiki
14.4.8, 14.10.4, and 15.0 RC1. There is no workaround apart from upgrading to a fixed version.
(CVE-2023-37910)
See Also
Plugin Details
Severity: High
ID: 418977
Version: Revision 1.6
Type: Local
Family: SCA Checks
Published: 1/23/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 4.3
Percentile: 53.37
Vendor
Vendor Severity: High
CVSS v2
Risk Factor: High
Base Score: 8.5
Temporal Score: 6.7
Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:N
CVSS Score Source: CVE-2023-37910
CVSS v3
Risk Factor: High
Base Score: 8.1
Temporal Score: 7.3
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 10/25/2023
Vulnerability Publication Date: 10/25/2023
Reference Information
CVE: CVE-2023-37910
cwe: CWE-862