XWiki IDOR Vulnerability Allows Deletion/Modification of Other Users' Custom Filters

From this webpage screenshot, we can extract the following key information about the vulnerability: 1. Vulnerability Type: Security Vulnerability 2. Priority: Critical 3. Affected Version: 13.2-rc-1 4. Component: Notifications 5. Tags: Attack Simulation, Attacker Account, Intigriti, Security 6. Description: - Submission Code: XWIKI-THQ6NW33 - Submission URL: https://www.intigriti.com/auth/dashboard?redirect=/submissions/e95a7ad5-7029-4627-abf0-3e3e3ea0b4ce/XWIKI-THQ6NW33 - Submitter: floerer - Creation Time: November 3, 2022, 07:19:07 GMT - Submission Status: Archived - Report Content: - Severity: Medium (5.3) - Domain: https://intigriti.xwiki.com/ (URL) - Vulnerability Description: A user can delete other users' custom filters or enable/disable them via an IDOR (Insecure Direct Object References) vulnerability. Steps to Reproduce: 1. Log in to https://intigriti.xwiki.com using the username "floerer" and password "Intigriti1". 2. Navigate to https://intigriti.xwiki.com/xwiki/bin/edit/XWiki/floerer?editor=inline&category=notifications and scroll to the bottom. 3. You will see a "Custom Filter" option. 4. Log in to https://intigriti.xwiki.com using a different account with username "floerer1" and password "Intigriti1". 5. By clicking on "Custom Filter" and using the credentials of the other account, the filter can be deleted or disabled. This information indicates that the vulnerability allows unauthorized access and modification of other users' custom filters through specific URLs and credentials, potentially leading to security risks.

Goal Reached Thanks to every supporter — we hit 100%!

XWiki IDOR Vulnerability Allows Deletion/Modification of Other Users' Custom Filters