CVE-2022-29253CWE-22CWE-24

Path Traversal in XWiki Platform

Low · published May 25, 2022

CVSS v3.1
2.7
EPSS
1%
Percentile
65.1
In the wild
Unconfirmed
What it is

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting with version 8.3-rc-1 and prior to versions 12.10.3 and 14.0, one can ask for any file located in the classloader using the template API and a path with ".." in it. The issue is patched in versions 14.0 and 13.10.3. There is no easy workaround for this issue.

The record
Technical detail
CVSS v3.1
2.7 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01092 · 65.1th percentile
Weaknesses
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'); CWE-24 · Path Traversal: '../filedir'
Published
2022-05-25T20:55Z
EPSS history
Timeline
  • 25 MAY 20:55Z
    Path Traversal in XWiki Platform
    cvelistv5