Description
XWiki is an open-source wiki software platform. From 16.7.0 to 16.10.11, 17.4.4, or 17.7.0, in an instance which is using the XWiki Jetty package (XJetty), a context is exposed to statically access any file located in the webapp/ folder. It allows accessing files which might contains credentials. Fixed in 16.10.11, 17.4.4, and 17.7.0.
Remediation
References
Related Vulnerabilities
WordPress Plugin eHive Object Details Cross-Site Scripting (2.1.6)
WordPress Plugin Web to Print Online Designer Security Bypass (2.3.0)
Oracle JRE CVE-2014-0446 Vulnerability (CVE-2014-0446)
Oracle JRE CVE-2013-0427 Vulnerability (CVE-2013-0427)
Oracle Database Server CVE-2010-0860 Vulnerability (CVE-2010-0860)