Lucene search

K
osvGoogleOSV:GHSA-92WP-R7HM-42G7
HistoryMar 03, 2023 - 10:50 p.m.

XWiki Platform subject to Uncontrolled Resource Consumption

2023-03-0322:50:41
Google
osv.dev
5
xwiki platform uncontrolled resource consumption
memory allocation
xwiki 14.0 patch
farm usability

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

43.2%

Impact

It’s possible to make the farm unusable by adding an object to a page with a huge number (e.g. 67108863). This will most of the time fill the memory allocated to XWiki and make it unusable every time this document is manipulated.

Patches

It has been patched in XWiki 14.0

Workarounds

There is no workaround.

References

https://jira.xwiki.org/browse/XWIKI-19223

For more information

If you have any questions or comments about this advisory:

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

43.2%

Related for OSV:GHSA-92WP-R7HM-42G7