GHSA-JP55-VVMF-63MV中危已审查

URL Redirection to Untrusted Site ('Open Redirect')

OSV 1.4.0 · github-reviewed · 修改于 2022-02-10 05:42

发布时间

2022-02-10 05:42

GitHub 审查时间

2022-02-10 05:42

NVD 发布时间

2022-02-10 05:15

源文件

advisories/github-reviewed/2022/02/GHSA-jp55-vvmf-63mv/GHSA-jp55-vvmf-63mv.json

公告说明

Impact

There's no protection against URL redirection to untrusted site, in particular some well known parameters (xredirect) can be used to perform such redirections.

Patches

The problem has been patched in XWiki 12.10.7 and XWiki 13.3RC1.

Workarounds

There's no known workaround for this issue.

References

https://jira.xwiki.org/browse/XWIKI-10309

For more information

If you have any questions or comments about this advisory:

Open an issue in JIRA
Email us at Security ML

受影响的软件包

Maven

org.xwiki.platform:xwiki-platform-oldcore

ECOSYSTEM

标识信息

别名 / CVE

CVE-2022-23618

CWE

CWE-601

软件生态

Maven

扩展资料

暂无扩展资料。

CVSS 评分

CVSS_V3

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

原始 OSV JSON

{
  "id": "GHSA-jp55-vvmf-63mv",
  "aliases": [
    "CVE-2022-23618"
  ],
  "details": "### Impact\nThere's no protection against URL redirection to untrusted site, in particular some well known parameters (xredirect) can be used to perform such redirections.\n\n### Patches\nThe problem has been patched in XWiki 12.10.7 and XWiki 13.3RC1.\n\n### Workarounds\nThere's no known workaround for this issue. \n\n### References\nhttps://jira.xwiki.org/browse/XWIKI-10309\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [JIRA](https://jira.xwiki.org)\n* Email us at [Security ML](mailto:[email protected])\n",
  "summary": "URL Redirection to Untrusted Site ('Open Redirect')",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "12.10.7"
            }
          ]
        }
      ],
      "package": {
        "name": "org.xwiki.platform:xwiki-platform-oldcore",
        "ecosystem": "Maven"
      }
    },
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "13.0.0"
            },
            {
              "fixed": "13.3RC1"
            }
          ]
        }
      ],
      "package": {
        "name": "org.xwiki.platform:xwiki-platform-oldcore",
        "ecosystem": "Maven"
      },
      "database_specific": {
        "last_known_affected_version_range": "<= 13.2"
      }
    }
  ],
  "modified": "2022-02-09T21:42:47Z",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N"
    }
  ],
  "published": "2022-02-09T21:42:47Z",
  "references": [
    {
      "url": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-jp55-vvmf-63mv",
      "type": "WEB"
    },
    {
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23618",
      "type": "ADVISORY"
    },
    {
      "url": "https://github.com/xwiki/xwiki-platform/commit/5251c02080466bf9fb55288f04a37671108f8096",
      "type": "WEB"
    },
    {
      "url": "https://github.com/xwiki/xwiki-platform",
      "type": "PACKAGE"
    },
    {
      "url": "https://jira.xwiki.org/browse/XWIKI-10309",
      "type": "WEB"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-601"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "nvd_published_at": "2022-02-09T21:15:00Z",
    "github_reviewed_at": "2022-02-09T21:42:47Z"
  }
}