CVE-2007-4888

The "You are not allowed..." error handler in XWiki 1.0 B1 and 1.0 B2 associates the doc variable with the entire document content and metadata regardless of a…

published September 14, 2007

CVSS
—
EPSS
1%
Percentile
55.2
In the wild
Unconfirmed
What it is

The "You are not allowed..." error handler in XWiki 1.0 B1 and 1.0 B2 associates the doc variable with the entire document content and metadata regardless of a user's view rights, which allows remote authenticated users to read arbitrary documents via a custom skin that prints the content attribute of the doc variable.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00773 · 55.2th percentile
Published
2007-09-14T00:00Z
EPSS history
Timeline
  • 14 SEP 00:00Z
    The "You are not allowed..." error handler in XWiki 1.0 B1 and 1.0 B2 associates the doc variable with the entire document content and metadata regardless of a…
    cvelistv5