{"id":"CVE-2023-37910","summary":"org.xwiki.platform:xwiki-platform-attachment-api vulnerable to Missing Authorization on Attachment Move","details":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting with the introduction of attachment move support in version 14.0-rc-1 and prior to versions 14.4.8, 14.10.4, and 15.0-rc-1, an attacker with edit access on any document (can be the user profile which is editable by default) can move any attachment of any other document to this attacker-controlled document. This allows the attacker to access and possibly publish any attachment of which the name is known, regardless if the attacker has view or edit rights on the source document of this attachment. Further, the attachment is deleted from the source document. This vulnerability has been patched in XWiki 14.4.8, 14.10.4, and 15.0 RC1. There is no workaround apart from upgrading to a fixed version.","aliases":["GHSA-rwwx-6572-mp29"],"modified":"2026-08-12T14:51:07.596251Z","published":"2023-10-25T17:17:23.795Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-862"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/37xxx/CVE-2023-37910.json"},"references":[{"type":"WEB","url":"https://jira.xwiki.org/browse/XWIKI-20334"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/37xxx/CVE-2023-37910.json"},{"type":"ADVISORY","url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-rwwx-6572-mp29"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-37910"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/d7720219d60d7201c696c3196c9d4a86d0881325"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/xwiki/xwiki-commons","events":[{"introduced":"491547c4f74b9be58123ef22081ae7e6840a11c7"},{"fixed":"48ee3193230753aecf8a86d7c8ff3e8f869e8330"},{"introduced":"bae1e23e73cafc007e5f28b39a04bfa0acf0199c"},{"fixed":"dfd0eff6a9f28f5a8840a5e4a51f0a24524c0280"}],"database_specific":{"source":"CPE_RANGE","cpe":"cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"14.0"},{"fixed":"14.4.8"},{"introduced":"14.5"},{"fixed":"14.10.4"}]}},{"type":"GIT","repo":"https://github.com/xwiki/xwiki-platform","events":[{"introduced":"d971304b0e0bf4f6dad278de89518edc17459741"},{"fixed":"b469b950e7fe3d22f00b639d43f286bf871472b1"},{"introduced":"ab4dfeaeef13360eebcaa507bc652073aa89a427"},{"fixed":"c127075e7814ef7cd164bb6493d67b1943b6db1e"},{"fixed":"d7720219d60d7201c696c3196c9d4a86d0881325"}],"database_specific":{"cpe":"cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"14.0"},{"fixed":"14.4.8"},{"introduced":"14.5"},{"fixed":"14.10.4"}],"source":["CPE_RANGE","REFERENCES"]}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-37910.json","vanir_signatures_modified":"2026-08-12T14:51:07Z","vanir_signatures":[{"id":"CVE-2023-37910-1aa4e219","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/d7720219d60d7201c696c3196c9d4a86d0881325","target":{"file":"xwiki-platform-core/xwiki-platform-attachment/xwiki-platform-attachment-api/src/test/java/org/xwiki/attachment/internal/refactoring/job/MoveAttachmentJobTest.java"},"deprecated":false,"digest":{"line_hashes":["185218092907293331056919951048042709006","293536063665795540341459595765815687745","289534493823765779280433279589837744253","153641866887580729244127297533596686955","172138294862237988821858739613034305397","181866756157596147653808532336396974280","63759343589745921564566788841849614272","20254521194833351203412864049182831291","293002508912059807465989446790715683171","172755217235849959176223394710221687746","122175079589792405307991265248177774574","69385334933888457630873266542656323005","204694374223297318011626262488329480715","306566954771048139087386440549240193007","236140060152490964392354107913837721718","65449434484264876750180988811904694231","20597833014556872801825632903591121151","267719944282925787237771201404597481098","295693931073532115253087974617359541603","112916403726207148752481735944829284777","116848501862941023783327433619288333396","148707590576425276252183495678859885162","105737845281766365846874089201200288736","244215771174348869125738359908664723902","21402992388833835359551208393593727354","222197916815068076465763838306480275330","275227315160069719573673088805017202276","310520412250282110229064748055672822908","106882583123264755386151481993219645971","167738529855861589407382718311554529035","85183243232432940184534669976721728269","129068039383956070010932556605464746405","165188777160453315387466693667167428467","230006698406857033360256102807385905949","321756364684189096826911232775595243707","180435905936353718927708464153729161860","49920740699191785734252275486852715662","215021072935646039800990894189733153403","143576829412167678971900536678266594058","316828558314952058543808131302560505933","155653207210399171571506894511521172039","230006698406857033360256102807385905949","321756364684189096826911232775595243707","180435905936353718927708464153729161860","183470340839777220818955617018603382918","24293932752245576698753361551562748635"],"threshold":0.9}},{"digest":{"function_hash":"215519081834995700904390192374825569708","length":769},"id":"CVE-2023-37910-8984af74","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/d7720219d60d7201c696c3196c9d4a86d0881325","target":{"file":"xwiki-platform-core/xwiki-platform-attachment/xwiki-platform-attachment-api/src/main/java/org/xwiki/attachment/internal/refactoring/job/MoveAttachmentJob.java","function":"process"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/d7720219d60d7201c696c3196c9d4a86d0881325","target":{"file":"xwiki-platform-core/xwiki-platform-attachment/xwiki-platform-attachment-api/src/test/java/org/xwiki/attachment/internal/refactoring/job/MoveAttachmentJobTest.java","function":"setUp"},"deprecated":false,"digest":{"function_hash":"258087321640585093654331498029748731560","length":1465},"id":"CVE-2023-37910-8caef82a"},{"signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/d7720219d60d7201c696c3196c9d4a86d0881325","target":{"file":"xwiki-platform-core/xwiki-platform-attachment/xwiki-platform-attachment-api/src/main/java/org/xwiki/attachment/internal/refactoring/job/MoveAttachmentJob.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["176275698136761170675905662123579419757","324095061013860438544865018786550456342","35659041267030976155462213234105371239","134614838425349295598667546265960328036","293615355681760997781413826950625608799","237237645390966381142349059968300881691","147203953684166364427882530207370066206","157970577346605740304356312663147363822","157967593747224808698911675388268300069","250301987990996153787455252312570777608","266799012598242189845716063429219418673","207674843639436006624481362320653715493","219822220098777629166204719547398695677","78864507635111087585196255042983804602","233800537074441609055847893036133682572","52260497251734130939358280735373564042","167699568058473141432845256199566132769","13253631106072111798136503706961722661"]},"id":"CVE-2023-37910-a5b43a12","signature_type":"Line"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/d7720219d60d7201c696c3196c9d4a86d0881325","target":{"file":"xwiki-platform-core/xwiki-platform-attachment/xwiki-platform-attachment-api/src/test/java/org/xwiki/attachment/internal/refactoring/job/MoveAttachmentJobTest.java","function":"process"},"deprecated":false,"digest":{"function_hash":"1637597822119104438202122301815352991","length":2155},"id":"CVE-2023-37910-cb57928b"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/d7720219d60d7201c696c3196c9d4a86d0881325","target":{"file":"xwiki-platform-core/xwiki-platform-attachment/xwiki-platform-attachment-api/src/test/java/org/xwiki/attachment/internal/refactoring/job/MoveAttachmentJobTest.java","function":"processRename"},"deprecated":false,"digest":{"function_hash":"31690463128576026889428255640606878655","length":1755},"id":"CVE-2023-37910-dd65efe8"},{"id":"CVE-2023-37910-e2c2e501","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/d7720219d60d7201c696c3196c9d4a86d0881325","target":{"file":"xwiki-platform-core/xwiki-platform-attachment/xwiki-platform-attachment-api/src/test/java/org/xwiki/attachment/internal/refactoring/job/MoveAttachmentJobTest.java","function":"processTargetSaveFail"},"deprecated":false,"digest":{"function_hash":"47517613894498968316684213495467154635","length":2826}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"}]}