Lucene search

K
githubGitHub Advisory DatabaseGHSA-92WP-R7HM-42G7
HistoryMar 03, 2023 - 10:50 p.m.

XWiki Platform subject to Uncontrolled Resource Consumption

2023-03-0322:50:41
CWE-400
CWE-787
GitHub Advisory Database
github.com
10
xwiki platform
uncontrolled resource consumption
memory exhaustion
security advisory
patch

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

0.001 Low

EPSS

Percentile

43.2%

Impact

It’s possible to make the farm unusable by adding an object to a page with a huge number (e.g. 67108863). This will most of the time fill the memory allocated to XWiki and make it unusable every time this document is manipulated.

Patches

It has been patched in XWiki 14.0

Workarounds

There is no workaround.

References

https://jira.xwiki.org/browse/XWIKI-19223

For more information

If you have any questions or comments about this advisory:

Affected configurations

Vulners
Node
org.xwiki.platform\Matchxwiki-platform-oldcore

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

0.001 Low

EPSS

Percentile

43.2%

Related for GHSA-92WP-R7HM-42G7