CVE-2022-29253: Path Traversal: '../filedir'

June 1, 2022

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting with version 8.3-rc-1 and prior to versions 12.10.3 and 14.0, one can ask for any file located in the classloader using the template API and a path with “..” in it. The issue is patched in versions 14.0 and 13.10.3. There is no easy workaround for this issue.

References

github.com/advisories/GHSA-9qrp-h7fw-42hg
github.com/xwiki/xwiki-platform/commit/4917c8f355717bb636d763844528b1fe0f95e8e2
github.com/xwiki/xwiki-platform/security/advisories/GHSA-9qrp-h7fw-42hg
jira.xwiki.org/browse/XWIKI-19349
nvd.nist.gov/vuln/detail/CVE-2022-29253

Code Behaviors & Features

Detect and mitigate CVE-2022-29253 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →