CVE-2023-29208

Name of the Vulnerable Software and Affected Versions XWiki Commons versions prior to 14.10

Description The issue concerns rights added to a document not being taken into account for viewing it once it's deleted. This specifically impacts deleted documents that contained view rights. However, view rights provided on a space of a deleted document are properly checked. The problem has been resolved by checking the rights of the current user, allowing only admins and the deleter of the document to view it.

Recommendations For versions prior to 14.10, update to XWiki 14.10 to resolve the issue by implementing the patch that checks the rights of the current user, restricting viewing of deleted documents to admins and the document's deleter.