CVE-2022-41937 Missing Authorization in XWiki Platform

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The application allows anyone with view access to modify any page of the wiki by importing a crafted XAR package. The problem has been patched in XWiki 14.6RC1, 14.6 and 13.10.8. As a...

CVE-2022-41937

XWiki Platform suffered a Missing Authorization vulnerability where any user with view access could modify pages by importing a crafted XAR package. The issue stems from improper privilege management and was fixed in XWiki 14.6RC1, 14.6, and 13.10.8. A workaround is to restrict the Filter.WebHome...

Missing Authorization in Filter Stream Converter Application of XWiki-platform

Impact The application allow anyone with view access to modify any page of the wiki by importing a crafted XAR package. Patches The problem has been patched in XWiki 14.6RC1, 14.6 and 13.10.8. Workarounds The problem can be patched immediately by setting the right of the page Filter.WebHome and...

GHSA-Q6JP-GCWW-8V2J Missing Authorization in Filter Stream Converter Application of XWiki-platform

Impact The application allow anyone with view access to modify any page of the wiki by importing a crafted XAR package. Patches The problem has been patched in XWiki 14.6RC1, 14.6 and 13.10.8. Workarounds The problem can be patched immediately by setting the right of the page Filter.WebHome and...

GHSA-P88W-FHXW-XVCC Exposure of Private Personal Information to an Unauthorized Actor in org.xwiki.platform:xwiki-platform-rest-server

Impact The modifications rest endpoint does not filter out entries according to the user's rights. Therefore, information hidden from unauthorized users are exposed though the modifications rest endpoint e.g., comments, page names.... Patches Users should upgrade to XWiki 14.6+, 14.4.3+,...

Exposure of Private Personal Information to an Unauthorized Actor in org.xwiki.platform:xwiki-platform-rest-server

Impact The modifications rest endpoint does not filter out entries according to the user's rights. Therefore, information hidden from unauthorized users are exposed though the modifications rest endpoint e.g., comments, page names.... Patches Users should upgrade to XWiki 14.6+, 14.4.3+,...

GHSA-P2X4-6GHR-6VMQ Exposure of Sensitive Information to an Unauthorized Actor in org.xwiki.platform:xwiki-platform-livetable-ui

Impact User without the right to view documents can deduce their existence by repeated Livetable queries. Reproduction steps 1. Restrict "view" access to Sandbox.TestPage3 by setting an explicit view right for admins 1. As a user who is not an admin, open...

Exposure of Sensitive Information to an Unauthorized Actor in org.xwiki.platform:xwiki-platform-livetable-ui

Impact User without the right to view documents can deduce their existence by repeated Livetable queries. Reproduction steps 1. Restrict "view" access to Sandbox.TestPage3 by setting an explicit view right for admins 1. As a user who is not an admin, open...

GHSA-6W8H-26XX-CF8Q Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in org.xwiki.platform:xwiki-platform-menu-ui

Impact Any user with view rights on commonly accessible documents including the menu macro can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation due to improper escaping of the macro content and parameters of the menu macro. The issue can ...

Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in org.xwiki.platform:xwiki-platform-menu-ui

Impact Any user with view rights on commonly accessible documents including the menu macro can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation due to improper escaping of the macro content and parameters of the menu macro. The issue can ...

GHSA-Q2HM-2H45-V5G3 Plaintext storage of password after a reset in org.xwiki.platform:xwiki-platform-security-authentication-default

Impact We discovered that when the reset a forgotten password feature of XWiki was used, the password was then stored in plain text in database. This only concerns XWiki 13.1RC1 and next versions. Note that it only concerns the reset password feature available from the "Forgot your password" link...

Plaintext storage of password after a reset in org.xwiki.platform:xwiki-platform-security-authentication-default

Impact We discovered that when the reset a forgotten password feature of XWiki was used, the password was then stored in plain text in database. This only concerns XWiki 13.1RC1 and next versions. Note that it only concerns the reset password feature available from the "Forgot your password" link...

GHSA-4X5R-6V26-7J4V Creation of new database tables through login form on PostgreSQL

Impact It's possible to make XWiki create many new schemas and fill them with tables just by using a crafted user identifier in the login form. Patches The problem has been patched in XWiki 13.10.8, 14.6RC1 and 14.4.2. Workarounds The only workarounds for this are: use an authenticator which does...

Creation of new database tables through login form on PostgreSQL

Impact It's possible to make XWiki create many new schemas and fill them with tables just by using a crafted user identifier in the login form. Patches The problem has been patched in XWiki 13.10.8, 14.6RC1 and 14.4.2. Workarounds The only workarounds for this are: use an authenticator which does...

Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in xwiki-platform-icon-ui

Impact Any user with view rights on commonly accessible documents including the icon picker macro can execute arbitrary Groovy, Python or Velocity code in XWiki due to improper neutralization of the macro parameters of the icon picker macro. The URL...

GHSA-5J7G-CF6R-G2H7 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in xwiki-platform-icon-ui

Impact Any user with view rights on commonly accessible documents including the icon picker macro can execute arbitrary Groovy, Python or Velocity code in XWiki due to improper neutralization of the macro parameters of the icon picker macro. The URL...

Missing Authorization to enable or disable users in org.xwiki.platform:xwiki-platform-user-profile-ui

Impact Any user logged in or not with access to the page XWiki.XWikiUserProfileSheet can enable or disable any user profile. This might allow to a disabled user to re-enable themselves, or to an attacker to disable any user of the wiki. Patches The problem has been patched in XWiki 13.10.7, 14.5R...

GHSA-P5V9-G8W8-5Q4V Missing Authorization to enable or disable users in org.xwiki.platform:xwiki-platform-user-profile-ui

Impact Any user logged in or not with access to the page XWiki.XWikiUserProfileSheet can enable or disable any user profile. This might allow to a disabled user to re-enable themselves, or to an attacker to disable any user of the wiki. Patches The problem has been patched in XWiki 13.10.7, 14.5R...

GHSA-2GJ2-VJ98-J2QQ Missing Authorization in User#setDisabledStatus in org.xwiki.platform:xwiki-platform-oldcore

Impact It's possible for a user with only Script rights to enable or disable a user: this operation should be only doable for users with admin rights. Patches This problem has been patched in XWiki 13.10.7, 14.4.2 and 14.5RC1. Workarounds There is no workaround other than upgrading the wiki, but...

Missing Authorization in User#setDisabledStatus in org.xwiki.platform:xwiki-platform-oldcore

Impact It's possible for a user with only Script rights to enable or disable a user: this operation should be only doable for users with admin rights. Patches This problem has been patched in XWiki 13.10.7, 14.4.2 and 14.5RC1. Workarounds There is no workaround other than upgrading the wiki, but...