3556 matches found
GHSA-GG53-WF5X-R3R6 XWiki Platform Security Parent POM vulnerable to overwriting of security rules of a page with a final page having the same reference
Impact A bug in the security cache is storing rules associated to document Page1.Page2 and space Page1.Page2 in the same cache entry. That means that it's possible to overwrite the rights of a space or a document by creating the page of the space with the same name and checking the right of the n...
XWiki Platform Security Parent POM vulnerable to overwriting of security rules of a page with a final page having the same reference
Impact A bug in the security cache is storing rules associated to document Page1.Page2 and space Page1.Page2 in the same cache entry. That means that it's possible to overwrite the rights of a space or a document by creating the page of the space with the same name and checking the right of the n...
XWiki Cross-Site Request Forgery (CSRF) for actions on tags
Impact It's possible to perform a CSRF attack for adding or removing tags on XWiki pages. Patches The problem has been patched in XWiki 13.10.5 and 14.3. Workarounds It's possible to fix the issue without upgrading by locally modifying the documentTags.vm template in your filesystem, to apply the...
GHSA-FXWR-4VQ9-9VHJ XWiki Cross-Site Request Forgery (CSRF) for actions on tags
Impact It's possible to perform a CSRF attack for adding or removing tags on XWiki pages. Patches The problem has been patched in XWiki 13.10.5 and 14.3. Workarounds It's possible to fix the issue without upgrading by locally modifying the documentTags.vm template in your filesystem, to apply the...
XWiki Platform Improper Authorization check for inactive users
Impact Some resources are missing a check for inactive not yet activated or disabled users in XWiki, including the REST service: so a disabled user can enable themselves using a REST call. On the same way some resources handler created by extensions are not protected by default: so an inactive...
GHSA-JGC8-GVCX-9VFX XWiki Platform Improper Authorization check for inactive users
Impact Some resources are missing a check for inactive not yet activated or disabled users in XWiki, including the REST service: so a disabled user can enable themselves using a REST call. On the same way some resources handler created by extensions are not protected by default: so an inactive...
XWiki Platform Web Templates vulnerable to Missing Authorization, Exposure of Private Personal Information to Unauthorized Actor
Impact Through the suggestion feature, string and list properties of objects the user shouldn't have access to can be accessed. This includes private personal information like email addresses and salted password hashes of registered users but also other information stored in properties of objects...
GHSA-599V-W48H-RJRM XWiki Platform Web Templates vulnerable to Missing Authorization, Exposure of Private Personal Information to Unauthorized Actor
Impact Through the suggestion feature, string and list properties of objects the user shouldn't have access to can be accessed. This includes private personal information like email addresses and salted password hashes of registered users but also other information stored in properties of objects...
GHSA-GJMQ-X5X7-WC36 XWiki Platform vulnerable to Cross-site Scripting in the deleted attachments list
Impact It's possible to store a JavaScript which will be executed by anyone viewing the deleted attachments index with an attachment containing javascript in its name. For example, attachment a file with name .jpg will execute the alert. Patches This issue has been patched in XWiki 13.10.6 and...
XWiki Platform vulnerable to Cross-site Scripting in the deleted attachments list
Impact It's possible to store a JavaScript which will be executed by anyone viewing the deleted attachments index with an attachment containing javascript in its name. For example, attachment a file with name .jpg will execute the alert. Patches This issue has been patched in XWiki 13.10.6 and...
GHSA-9R9J-57RF-F6VJ XWiki Platform Attachment UI vulnerable to cross-site scripting in the move attachment form
Impact It's possible to store JavaScript in an attachment name, which will be executed by anyone trying to move the corresponding attachment. For example, an attachment with name .jpg will execute the alert. Patches This issue has been patched in XWiki 14.4RC1. Workarounds It is possible to fix t...
XWiki Platform Attachment UI vulnerable to cross-site scripting in the move attachment form
Impact It's possible to store JavaScript in an attachment name, which will be executed by anyone trying to move the corresponding attachment. For example, an attachment with name .jpg will execute the alert. Patches This issue has been patched in XWiki 14.4RC1. Workarounds It is possible to fix t...
GHSA-C5V8-2Q4R-5W9V XWiki Platform Mentions UI vulnerable to Cross-site Scripting
Impact It's possible to store Javascript or groovy scripts in an mention macro anchor or reference field. The stored code is executed by anyone visiting the page with the mention. For example, the example below will create a file at /tmp/exploit.txt: mention reference="XWiki.Translation"...
XWiki Platform Mentions UI vulnerable to Cross-site Scripting
Impact It's possible to store Javascript or groovy scripts in an mention macro anchor or reference field. The stored code is executed by anyone visiting the page with the mention. For example, the example below will create a file at /tmp/exploit.txt: mention reference="XWiki.Translation"...
GHSA-XR6M-2P4M-JVQF XWiki Platform Wiki UI Main Wiki Eval Injection vulnerability
Impact It's possible to inject arbitrary wiki syntax including Groovy, Python and Velocity script macros via the request URL parameter using the XWikiServerClassSheet if the user has view access to this sheet and another page that has been saved with programming rights, a standard condition on a...
XWiki Platform Wiki UI Main Wiki Eval Injection vulnerability
Impact It's possible to inject arbitrary wiki syntax including Groovy, Python and Velocity script macros via the request URL parameter using the XWikiServerClassSheet if the user has view access to this sheet and another page that has been saved with programming rights, a standard condition on a...
XWiki Platform Applications Tag and XWiki Platform Tag UI vulnerable to Eval Injection
Impact The tags document Main.Tags in XWiki didn't sanitize user inputs properly, allowing users with view rights on the document default in a public wiki or for authenticated users on private wikis to execute arbitrary Groovy, Python and Velocity code with programming rights. This allows bypassi...
GHSA-2G5C-228J-P52X XWiki Platform Applications Tag and XWiki Platform Tag UI vulnerable to Eval Injection
Impact The tags document Main.Tags in XWiki didn't sanitize user inputs properly, allowing users with view rights on the document default in a public wiki or for authenticated users on private wikis to execute arbitrary Groovy, Python and Velocity code with programming rights. This allows bypassi...
XWiki Platform Old Core vulnerable to Authentication Bypass Using the Login Action
Impact All rights checks that would normally prevent a user from viewing a document on a wiki can be bypassed using the login action and directly specified templates. This exposes title, content and comments of any document and properties of objects class and property name must be known, though...
GHSA-8H89-34W2-JPFM XWiki Platform Old Core vulnerable to Authentication Bypass Using the Login Action
Impact All rights checks that would normally prevent a user from viewing a document on a wiki can be bypassed using the login action and directly specified templates. This exposes title, content and comments of any document and properties of objects class and property name must be known, though...