Uploaded image for project: 'XWiki Platform'
  1. XWiki Platform
  2. XWIKI-18850

Unauthenticated user can retrieve the list of users through uorgsuggest.vm

    XMLWordPrintable

Details

    • Unit
    • Unknown
    • N/A
    • N/A
    • Pull Request accepted

    Description

      An unauthenticated user can retrieve a list of users and their fullname through a public accessible URL.

      Reproducing steps:
      Navigate to :

      http://<server>/bin/login/XWikiLogin?xpage=uorgsuggest&uorg=user&wiki=&media=json

      Results:

      • uorgsuggest gives access to user fullname and reference even if the wiki is private

      Expected Results:

      • User fullname and documents fullname should not be accessible to anyone who don't have corresponding rights

      Attachments

        Issue Links

          is related to

          Bug - A problem which impairs or prevents the functions of the product. XWIKI-18851 Unauthenticated user can retrieve user information through getdeleteddocuments.vm

          • Blocker - Blocks development and/or testing work, production could not run.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. XWIKI-16544 Unauthenticated user can retrieve the list of users through getdocuments.vm

          • Minor - Minor loss of function, or other problem where easy workaround is present.
          • Closed
          relates to

          Bug - A problem which impairs or prevents the functions of the product. XWIKI-18849 Private user data are accessible through suggest.vm

          • Blocker - Blocks development and/or testing work, production could not run.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. XWIKI-20007 When sharing a page from a subwiki, global users with restricted access get suggested

          • Major - Major loss of function.
          • Closed
          links to

          Web Link GHSA-97jg-43c9-q6pf

          Activity

            People

              mleduc Manuel Leduc
              gcoquard Guillaume COQUARD
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: