CVE-2007-4888 Information

Description

The \You are not allowed…\ error handler in XWiki 1.0 B1 and 1.0 B2 associates the doc variable with the entire document content and metadata regardless of a user’s view rights which allows remote authenticated users to read arbitrary documents via a custom skin that prints the content attribute of the doc variable.

Reference

http://jira.xwiki.org/jira/browse/XWIKI-726 http://osvdb.org/40499