Official description · CVE.orgSource dataSource dataCopied from an authoritative feed: NVD, CVE.org, CISA KEV, FIRST EPSS or MITRE CTID mappings, or labelled by the annotators of a published dataset. Copied from CVE.org.
XWiki is an open-source wiki software platform. From 16.7.0 to 16.10.11, 17.4.4, or 17.7.0, in an instance which is using the XWiki Jetty package (XJetty), a context is exposed to statically access any file located in the webapp/ folder. It allows accessing files which might contains credentials. Fixed in 16.10.11, 17.4.4, and 17.7.0.
Priority scorePatchfirst’s 0 to 100 ranking. It adds points for CISA KEV listing, ransomware use, EPSS, threat reports, public exploit code and CVSS. Every CVE page shows the breakdown.Breakdown
65.8 / 100
Exploited
Yes, in VulnCheck KEV
Reports
0
Tactics
0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linked
No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
Am I affected? What do I upgrade to?
From GitHub Security Advisories and OSVSourceSource dataCopied from an authoritative feed: NVD, CVE.org, CISA KEV, FIRST EPSS or MITRE CTID mappings, or labelled by the annotators of a published dataset. GitHub Security Advisories and OSV.
1 package in 1 ecosystem. Main package: org.xwiki.platform:xwiki-platform-tool-jetty-resources.