Description
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 4.2-milestone-2 through 16.10.6, configuration files are accessible through jsx and sx endpoints. It's possible to access and read configuration files by using URLs such as `http://localhost:8080/bin/ssx/Main/WebHome?resource=../../WEB-INF/xwiki.cfg&minify=false`. This is fixed in version 16.10.7.
Remediation
References
Related Vulnerabilities
phpMyAdmin CVE-2017-18264 Vulnerability (CVE-2017-18264)
WordPress Plugin MediaElement.js-HTML5 Video & Audio Player Cross-Site Scripting (4.2.8)
WordPress Plugin Cms Pack TimThumb Arbitrary File Upload (1.3)
Joomla URL Redirection to Untrusted Site ('Open Redirect') Vulnerability (CVE-2015-5608)
WordPress Plugin DZS Video Gallery Information Disclosure (3.1.3)