CVE-2023-36468 Upgrading doesn't prevent exploiting vulnerable XWiki documents

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When an XWiki installation is upgraded and that upgrade contains a fix for a bug in a document, just a new version of that document is added. In some cases, it's still possible to exploit the...

CVE-2023-36468

CVE-2023-36468 affects XWiki Platform. The advisory describes that upgrading to a fixed version does not always prevent exploitation: appending rev=1.1 to the reproduction URL can still trigger remote code execution despite patches. Patches exist in XWiki 14.10.7 and 15.2RC1, which force old revi...

CVE-2023-36469 Code injection through NotificationRSSService in XWiki Platform

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user who can edit their own user profile and notification settings can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including...

CVE-2023-36469 Code injection through NotificationRSSService in XWiki Platform

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user who can edit their own user profile and notification settings can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including...

CVE-2023-36469

CVE-2023-36469 affects XWiki Platform. The vulnerability allows any user who can edit their own profile and notification settings to execute arbitrary script macros (Groovy/Python), enabling remote code execution with full read/write access to wiki content. The root cause is in the NotificationRS...

CVE-2023-36469 Code injection through NotificationRSSService in XWiki Platform

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user who can edit their own user profile and notification settings can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including...

CVE-2023-36470

CVE-2023-36470 affects XWiki Platform. When a document is created or edited using an icon set, an attacker can inject XWiki syntax and Velocity code that runs with programming rights, enabling remote code execution. Attack vectors include the icon set HTML/XWiki syntax definitions and the icon pi...

CVE-2023-36470 Code injection in icon themes of XWiki Platform

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. By either creating a new or editing an existing document with an icon set, an attacker can inject XWiki syntax and Velocity code that is executed with programming rights and thus allows remote...

CVE-2023-36470 Code injection in icon themes of XWiki Platform

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. By either creating a new or editing an existing document with an icon set, an attacker can inject XWiki syntax and Velocity code that is executed with programming rights and thus allows remote...

CVE-2023-36470 Code injection in icon themes of XWiki Platform

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. By either creating a new or editing an existing document with an icon set, an attacker can inject XWiki syntax and Velocity code that is executed with programming rights and thus allows remote...

CVE-2023-36471

Xwiki commons is the common modules used by other XWiki top level projects. The HTML sanitizer that is included in XWiki since version 14.6RC1 allowed form and input HTML tags. In the context of XWiki, this allows an attacker without script right to either create forms that can be used for phishi...

Input validation

Xwiki commons is the common modules used by other XWiki top level projects. The HTML sanitizer that is included in XWiki since version 14.6RC1 allowed form and input HTML tags. In the context of XWiki, this allows an attacker without script right to either create forms that can be used for phishi...

CVE-2023-36471 HTML sanitizer allows form elements in restricted in org.xwiki.commons:xwiki-commons-xml

Xwiki commons is the common modules used by other XWiki top level projects. The HTML sanitizer that is included in XWiki since version 14.6RC1 allowed form and input HTML tags. In the context of XWiki, this allows an attacker without script right to either create forms that can be used for phishi...

CVE-2023-36471

CVE-2023-36471 affects XWiki Commons HTML sanitizer (XWiki Commons) where allowed tags include form/input elements. The underlying issue is that the HTML sanitizer allowed form-related tags since 14.6RC1, enabling an attacker without scripting rights to craft a form that could trigger remote code...

CVE-2023-36471 HTML sanitizer allows form elements in restricted in org.xwiki.commons:xwiki-commons-xml

Xwiki commons is the common modules used by other XWiki top level projects. The HTML sanitizer that is included in XWiki since version 14.6RC1 allowed form and input HTML tags. In the context of XWiki, this allows an attacker without script right to either create forms that can be used for phishi...

CVE-2023-36471 HTML sanitizer allows form elements in restricted in org.xwiki.commons:xwiki-commons-xml

Xwiki commons is the common modules used by other XWiki top level projects. The HTML sanitizer that is included in XWiki since version 14.6RC1 allowed form and input HTML tags. In the context of XWiki, this allows an attacker without script right to either create forms that can be used for phishi...

XWiki Platform 注入漏洞

XWiki Platform is a suite of Wiki platforms for creating web collaboration applications from the XWiki Foundation in France. An injection vulnerability exists in XWiki Platform versions 9.6-rc-1 through 14.10.6 and 15.0-rc-1 through 15.2-rc-1, which stems from the fact that any user who can edit...

XWiki Platform 安全漏洞

XWiki Platform is a suite of Wiki platforms for creating web collaboration applications from the XWiki Foundation in France. A security vulnerability exists in XWiki Platform versions 2.0 through 14.10.7 and 15.0-rc-1 through 15.2-rc-1, which stems from the fact that it is still possible to explo...

XWiki Platform 注入漏洞

XWiki Platform is a suite of Wiki platforms from the XWiki Foundation in France for creating web collaboration applications. An injection vulnerability exists in XWiki Platform versions prior to 14.10.6, 15.2-rc-1 and prior to 15.2-rc-1, which can be exploited to inject XWiki syntax and Velocity...

PT-2023-4818 · Xwiki · Xwiki Platform

Name of the Vulnerable Software and Affected Versions: XWiki Platform versions prior to 14.10.6 XWiki Platform versions prior to 15.2RC1 Description: The issue allows any user who can edit their own user profile and notification settings to execute arbitrary script macros, including Groovy and...