{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.xwiki.platform:xwiki-platform-livetable-ui"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "12.10.11"
            },
            {
              "fixed": "13.10.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.xwiki.platform:xwiki-platform-livetable-ui"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "14.0.0"
            },
            {
              "fixed": "14.4.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.xwiki.platform:xwiki-platform-livetable-ui"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "14.5.0"
            },
            {
              "fixed": "14.6-rc-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-41935"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-11-21T22:37:47Z",
    "nvd_published_at": "2022-11-23T20:15:00Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nUser without the right to view documents can deduce their existence by repeated Livetable queries.\n\n#### Reproduction steps\n\n1. Restrict \"view\" access to `Sandbox.TestPage3` by setting an explicit view right for admins\n1. As a user who is not an admin, open `\u003cserver\u003e/bin/get/XWiki/LiveTableResults?outputSyntax=plain\u0026classname=\u0026collist=doc.title%2Cdoc.location%2Cdoc.content\u0026doc.title=Sandbo\u0026doc.location=Sandbox.TestPage3\u0026doc.content=dummy\u0026limit=0` where `\u003cserver\u003e` is the URL of your XWiki installation.\n\n#### Expect Result:\n\nNo results are displayed as the user doesn\u0027t have view rights on Sandbox.TestPage3.\n\n##### Actual Result:\n\nThe result\n\n```json\n{\n  \"reqNo\": null,\n  \"matchingtags\": {},\n  \"tags\": [],\n  \"totalrows\": 1,\n  \"returnedrows\": 0,\n  \"offset\": 1,\n  \"rows\": [\n    {\n      \"doc_viewable\": false,\n      \"doc_fullName\": \"obfuscated\"\n    }\n  ]\n}\n```\n\nis displayed.\n\nThis reveals that a document `Sandbox.TestPage3` exists (we explicitly searched for this name) which has a title containing `\"Sandbo\"` and a content containing `\"dummy\"`. By starting with a single letter and then iteratively extending the match, the full content of the title/content or XObject properties can be discovered. Several tests can be combined in a single request to use binary search to narrow down the actual match from a list of possible characters/words. If the used alphabet is known and smaller than 128 distinct characters, it is possible to discover one character with 7 requests. Alternatively, frequencies of words and word pairs (2-gram frequencies) can be used to first guess whole words and only resort to guessing individual characters if none of the predicted words match, allowing a much faster recovery of the textual content. As it also depends on the content how easy the attack is and how much recovered content would be a \"successful\" attack, it is hard to quantify how many requests are necessary.\n\n### Patches\n\nThe issue has been patched in XWiki 14.6RC1, 13.10.8, and 14.4.3, the response is not properly cleaned up of obfuscated entries.\n\n### Workarounds\n\nThe [patch](https://github.com/xwiki/xwiki-platform/commit/1450b6e3c69ac7df25e5a2571186d1f43402facd#diff-5a739e5865b1f1ad9d79b724791be51b0095a0170cc078911c940478b13b949a) for the document `XWiki.LiveTableResultsMacros` can be manually applied or a XAR archive of a patched version can be [imported](https://www.xwiki.org/xwiki/bin/view/Documentation/UserGuide/Features/Imports#HImportingXWikipages), on versions \u003e= 12.10.11, \u003e= 13.9-rc-1, and \u003e= 13.4.4.\n\n### References\n\n- https://github.com/xwiki/xwiki-platform/commit/1450b6e3c69ac7df25e5a2571186d1f43402facd#diff-5a739e5865b1f1ad9d79b724791be51b0095a0170cc078911c940478b13b949a\n- https://jira.xwiki.org/browse/XWIKI-19999\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n- Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)\n- Email us at [Security Mailing List](mailto:security@xwiki.org)\n",
  "id": "GHSA-p2x4-6ghr-6vmq",
  "modified": "2022-11-21T22:37:47Z",
  "published": "2022-11-21T22:37:47Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-p2x4-6ghr-6vmq"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41935"
    },
    {
      "type": "WEB",
      "url": "https://github.com/xwiki/xwiki-platform/commit/1450b6e3c69ac7df25e5a2571186d1f43402facd#diff-5a739e5865b1f1ad9d79b724791be51b0095a0170cc078911c940478b13b949a"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/xwiki/xwiki-platform"
    },
    {
      "type": "WEB",
      "url": "https://jira.xwiki.org/browse/XWIKI-19999"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Exposure of Sensitive Information to an Unauthorized Actor in org.xwiki.platform:xwiki-platform-livetable-ui"
}