GHSA-mrqg-xmgm-rc5g
XWiki's REST APIs can list all pages/spaces, leading to unavailability
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.xwiki.platform:xwiki-platform-oldcore | >= 1.8-rc-1, < 16.10.16 | 16.10.16 |
| Maven | org.xwiki.platform:xwiki-platform-oldcore | >= 17.0.0-rc-1, < 17.4.8 | 17.4.8 |
| Maven | org.xwiki.platform:xwiki-platform-oldcore | >= 17.5.0-rc-1, < 17.10.1 | 17.10.1 |
| Maven | org.xwiki.platform:xwiki-platform-legacy-oldcore | >= 1.8-rc-1, < 16.10.16 | 16.10.16 |
| Maven | org.xwiki.platform:xwiki-platform-legacy-oldcore | >= 17.0.0-rc-1, < 17.4.8 | 17.4.8 |
| Maven | org.xwiki.platform:xwiki-platform-legacy-oldcore | >= 17.5.0-rc-1, < 17.10.1 | 17.10.1 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
REST API endpoints like `/xwiki/rest/wikis/xwiki/spaces/AnnotationCode/pages/AnnotationConfig/objects/AnnotationCode.AnnotationConfig/0/properties` list all available pages as part of the metadata for database list properties, which can exhaust available resources on large wikis.
### Patches
This problem has been patched by applying the configured query limit also to the available values for database list properties in XWiki 16.10.16, 17.4.8 and 17.10.1.
### Workarounds
We're not aware of any workarounds apart from upgrading the affected modules.
References
External links from the advisory. They lead to third-party sites.