[org.xwiki.platform:xwiki-platform-web] Unauthenticated user can list hidden document from multiple velocity templates in XWiki

Impact

A guest user without the right to view pages of the wiki can still list documents by rendering some velocity documents.

Patches

The problem has been patched in XWiki versions 12.10.11, 13.4.4, and 13.9-rc-1.

Workarounds

There is no known workaround for this problem.

References

https://jira.xwiki.org/browse/XWIKI-16544

For more information

If you have any questions or comments about this advisory:

• Open an issue in Jira XWiki
• Email us at our security mailing list

References

• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-qpp2-2mcp-2wm5
• https://nvd.nist.gov/vuln/detail/CVE-2022-24820
• https://jira.xwiki.org/browse/XWIKI-16544
• https://github.com/advisories/GHSA-qpp2-2mcp-2wm5