GHSA-F776-W9V2-7VFJ XWiki Change Request Application UI XSS and remote code execution through change request title

Impact It's possible for a user without any specific right to perform script injection and remote code execution just by inserting an appropriate title when creating a new Change Request. This vulnerability is particularly critical as Change Request aims at being created by user without any...

PT-2024-24346 · Xwiki · Xwiki Platform

Name of the Vulnerable Software and Affected Versions: XWiki Platform versions 3.0.1 through 4.10.18 XWiki Platform versions 15.5.4 and earlier XWiki Platform versions prior to 15.10-rc-1 Description: The HTML escaping tool used in XWiki does not escape , which can allow XWiki syntax injection an...

CVE-2023-45144

com.xwiki.identity-oauth:identity-oauth-ui is a package to aid in building identity and service providers based on OAuth authorizations. When a user logs in via the OAuth method, the identityOAuth parameters sent in the GET request is vulnerable to cross site scripting XSS and XWiki syntax...

Cross site scripting

com.xwiki.identity-oauth:identity-oauth-ui is a package to aid in building identity and service providers based on OAuth authorizations. When a user logs in via the OAuth method, the identityOAuth parameters sent in the GET request is vulnerable to cross site scripting XSS and XWiki syntax...

CVE-2023-45144 Remote code execution from login screen through unescaped URL parameter in OAuth Identity XWiki App

com.xwiki.identity-oauth:identity-oauth-ui is a package to aid in building identity and service providers based on OAuth authorizations. When a user logs in via the OAuth method, the identityOAuth parameters sent in the GET request is vulnerable to cross site scripting XSS and XWiki syntax...

CVE-2023-45144

The CVE concerns com.xwiki.identity-oauth:identity-oauth-ui used for OAuth-based identity providers. When logging in via OAuth, the identityOAuth GET parameter is vulnerable to XSS and XWiki syntax injection, enabling remote code execution via the groovy macro and impacting confidentiality, integ...

CVE-2023-45144 Remote code execution from login screen through unescaped URL parameter in OAuth Identity XWiki App

com.xwiki.identity-oauth:identity-oauth-ui is a package to aid in building identity and service providers based on OAuth authorizations. When a user logs in via the OAuth method, the identityOAuth parameters sent in the GET request is vulnerable to cross site scripting XSS and XWiki syntax...

CVE-2023-45144 Remote code execution from login screen through unescaped URL parameter in OAuth Identity XWiki App

com.xwiki.identity-oauth:identity-oauth-ui is a package to aid in building identity and service providers based on OAuth authorizations. When a user logs in via the OAuth method, the identityOAuth parameters sent in the GET request is vulnerable to cross site scripting XSS and XWiki syntax...

PT-2023-8621 · Xwiki · Identity-Oauth-Ui

Name of the Vulnerable Software and Affected Versions: com.xwiki.identity-oauth:identity-oauth-ui versions prior to 1.6 Description: The issue is related to the lack of protection of the web page structure, allowing a remote attacker to conduct a cross-site scripting XSS attack. When a user logs ...

OAuth Identity XWiki App Cross-Site Scripting Vulnerability

OAuth Identity XWiki App is an open source XWiki SAS library of essential elements for building identities and service providers based on OAuth authorization. A cross-site scripting vulnerability exists in OAuth Identity XWiki App, which stems from the identityOAuth parameter sent in a GET reques...

Change Request Cross-Site Scripting Vulnerability

Change Request is an open source library from XWiki Contrib. Change Request suffers from a cross-site scripting vulnerability that originates from a user without any specific privileges being able to perform script injection and remote code execution by simply inserting the appropriate headers wh...

PT-2024-24333 · Xwiki · Xwiki Platform

Name of the Vulnerable Software and Affected Versions: XWiki Platform versions 3.0.1 through 4.10.19 XWiki Platform versions 14.10.19 and earlier XWiki Platform versions 15.5.3 and earlier XWiki Platform versions prior to 15.10-rc-1 Description: XWiki Platform is a generic wiki platform. Remote...

The vulnerability of the XWiki Platform, a platform for creating collaborative web applications, is related to deficiencies in access control. Exploiting this vulnerability could allow a hacker to execute arbitrary code.

The vulnerability of the XWiki Platform lies in its lack of access control mechanisms. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

The vulnerability of the XWiki platform for creating collaborative web applications lies in authentication errors, which allow a malicious user to execute arbitrary web scripts with elevated privileges.

The vulnerability of the XWiki Platform lies in authentication errors. Exploiting this vulnerability allows a malicious actor to execute arbitrary web scripts with elevated privileges...

The vulnerability of the XWiki Platform, a platform for creating collaborative web applications, lies in its lack of protection for website structures. This allows attackers to insert arbitrary information into wiki projects.

The vulnerability of the XWiki Platform lies in the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to insert arbitrary information into the wiki project remotely...

The vulnerability of the XWiki platform, which involves exposing information in the wrong data area, allows a hacker to obtain the email addresses of all users.

The vulnerability of the XWiki Platform lies in the exposure of information in the error data area. Exploiting this vulnerability could allow a malicious actor to obtain the email addresses of all users...

The vulnerability of the XWiki Platform, a platform for creating collaborative web applications. This vulnerability arises due to the failure to take measures to eliminate special elements within it, allowing attackers to execute arbitrary code.

The vulnerability of the XWiki platform lies in its lack of measures to neutralize special elements. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

The vulnerability of the integration interface of CKEditor, a platform for creating collaborative web applications like XWiki Platform XWiki, arises from insufficient verification of the authenticity of executed requests. This allows attackers to carry out CSRF attacks.

The vulnerability of the CKEditor integration interface in the XWiki platform, which is used for creating collaborative web applications, stems from insufficient verification of the authenticity of executed requests. Exploiting this vulnerability could allow a malicious actor to carry out a CSRF...

The vulnerability of the XWiki Platform, related to the failure to implement measures to neutralize instructions in dynamically executed code, allows a perpetrator to execute arbitrary code with root privileges.

The vulnerability of the XWiki Platform lies in the lack of measures taken to neutralize instructions in dynamically executed code. Exploiting this vulnerability allows a malicious actor to execute arbitrary code with root privileges remotely...

The vulnerability of the Xwiki Commons modules on the XWiki platform, which is used for creating collaborative web applications. This allows a hacker to execute arbitrary code.

The vulnerability of the XWiki Commons modules on the XWiki platform, which is used for creating collaborative web applications, stems from the failure to address the issue of eliminating special elements. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...