CVE-2024-26138

Summary

CVE-2024-26138: A vulnerability was discovered in the XWiki licensor application, which allows the exposure of sensitive information related to active licenses and their owners. The document "Licenses.Code.LicenseJSON" contains instance IDs, first and last names, and email addresses of license owners, making this data publicly accessible. The instance ID can be linked to specific XWiki installations, potentially compromising data privacy. This information leakage can also facilitate targeted phishing attacks. While user information is typically public, email addresses are usually obfuscated, depending on the configuration. A fix for this issue is available in Application Licensing 1.24.2. No known workarounds exist besides upgrading to the latest version.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.