Impact
Mail.MailConfig
can be edited by any logged-in user by default. Consequently, they can:
- change the mail obfuscation configuration
- view and edit the mail sending configuration, including the smtp domain name and credentials.
Patches
The problem has been patched on XWiki 14.4.8, 15.1, and 14.10.6.
Workarounds
The rights of the Mail.MailConfig
page can be manually updated so that only a set of trusted users can view, edit and delete it (e.g., the XWiki.XWikiAdminGroup
group).
On 14.4.8+, 15.1-rc-1+, or 14.10.5+, if at startup Mail.MailConfig
does not have any rights defined, view
, edit
and delete
rights are automatically granted to the XWiki.XWikiAdminGroup
group.
See the corresponding patch.
References
For more information
If you have any questions or comments about this advisory:
Impact
Mail.MailConfig
can be edited by any logged-in user by default. Consequently, they can:Patches
The problem has been patched on XWiki 14.4.8, 15.1, and 14.10.6.
Workarounds
The rights of the
Mail.MailConfig
page can be manually updated so that only a set of trusted users can view, edit and delete it (e.g., theXWiki.XWikiAdminGroup
group).On 14.4.8+, 15.1-rc-1+, or 14.10.5+, if at startup
Mail.MailConfig
does not have any rights defined,view
,edit
anddelete
rights are automatically granted to theXWiki.XWikiAdminGroup
group.See the corresponding patch.
References
For more information
If you have any questions or comments about this advisory: