title: XWiki Denial of Service attack through attachments
description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A user able to attach a file to a page can post a malformed TAR file by manipulating file modification times headers, which when parsed by Tika, could cause a denial of service issue via CPU consumption. This vulnerability has been patched in XWiki 14.10.18, 15.5.3 and 15.8 RC1.
problem types: CWE-400: Uncontrolled Resource Consumption
affected:
{
vendor: xwiki
product: xwiki-platform
versions:
version: >= 14.10, < 14.10.18, status: affected
version: >= 15.0-rc-1, < 15.5.3, status: affected
version: >= 15.6-rc-1, < 15.8-rc-1, status: affected
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
]