Design/Logic Flaw

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with SCRIPT right can read any file located in the XWiki WAR for example xwiki.cfg and xwiki.properties through XWikiinvokeServletAndReturnAsString as...

Design/Logic Flaw

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions AbstractSxExportURLFactoryActionHandlerprocessSx does not escape anything from SSX document references when serializing it on filesystem, it is possible to for the HTML...

Cross site scripting

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions there is a cross site scripting XSS vector in the registerinline.vm template related to the xredirect hidden field. This template is only used in the following conditions:...

Missing authorization in xwiki-platform

Impact Any user with SCRIPT right EDIT right before XWiki 7.4 can read any file located in the XWiki WAR for example xwiki.cfg and xwiki.properties through XWikiinvokeServletAndReturnAsString: $xwiki.invokeServletAndReturnAsString"/WEB-INF/xwiki.cfg" Patches It has been patched in XWiki versions...

GHSA-2JHM-QP48-HV5J Missing authorization in xwiki-platform

Impact Any user with SCRIPT right EDIT right before XWiki 7.4 can read any file located in the XWiki WAR for example xwiki.cfg and xwiki.properties through XWikiinvokeServletAndReturnAsString: $xwiki.invokeServletAndReturnAsString"/WEB-INF/xwiki.cfg" Patches It has been patched in XWiki versions...

GHSA-7PH6-5CMQ-XGJQ Path traversal in xwiki-platform-skin-skinx

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. AbstractSxExportURLFactoryActionHandlerprocessSx does not escape anything from SSX document reference when serializing it on filesystem, so it's easy to mess up the HTML export process with...

Path traversal in xwiki-platform-skin-skinx

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. AbstractSxExportURLFactoryActionHandlerprocessSx does not escape anything from SSX document reference when serializing it on filesystem, so it's easy to mess up the HTML export process with...

Information exposure in xwiki-platform

Impact It's possible to guess if a user has an account on the wiki by using the "Forgot your password" form, even if the wiki is closed to guest users. Patches The problem has been patched on XWiki 12.10.9, 13.4.1 and 13.6RC1. Workarounds There's no easy workaround other than applying the upgrade...

GHSA-35FG-HJCR-J65F Information exposure in xwiki-platform

Impact It's possible to guess if a user has an account on the wiki by using the "Forgot your password" form, even if the wiki is closed to guest users. Patches The problem has been patched on XWiki 12.10.9, 13.4.1 and 13.6RC1. Workarounds There's no easy workaround other than applying the upgrade...

GHSA-JP55-VVMF-63MV URL Redirection to Untrusted Site ('Open Redirect')

Impact There's no protection against URL redirection to untrusted site, in particular some well known parameters xredirect can be used to perform such redirections. Patches The problem has been patched in XWiki 12.10.7 and XWiki 13.3RC1. Workarounds There's no known workaround for this issue...

URL Redirection to Untrusted Site ('Open Redirect')

Impact There's no protection against URL redirection to untrusted site, in particular some well known parameters xredirect can be used to perform such redirections. Patches The problem has been patched in XWiki 12.10.7 and XWiki 13.3RC1. Workarounds There's no known workaround for this issue...

GHSA-GF7X-2J2X-7F73 Missing authorization in xwiki-platform

Impact Any user with edit right can copy the content of a page it does not have access to by using it as template of a new page. Patches It has been patched in XWiki 13.2CR1 and 12.10.6 Workarounds There is no workaround beside patching. References https://jira.xwiki.org/browse/XWIKI-18430 For mo...

Missing authorization in xwiki-platform

Impact Any user with edit right can copy the content of a page it does not have access to by using it as template of a new page. Patches It has been patched in XWiki 13.2CR1 and 12.10.6 Workarounds There is no workaround beside patching. References https://jira.xwiki.org/browse/XWIKI-18430 For mo...

CVE-2022-23622 Cross site scripting in registration template in xwiki-platform

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions there is a cross site scripting XSS vector in the registerinline.vm template related to the xredirect hidden field. This template is only used in the following conditions:...

CVE-2022-23622 Cross site scripting in registration template in xwiki-platform

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions there is a cross site scripting XSS vector in the registerinline.vm template related to the xredirect hidden field. This template is only used in the following conditions:...

CVE-2022-23622

XWiki Platform contains an XSS vulnerability (CVE-2022-23622) in the registerinline.vm template associated with the xredirect hidden field. Exploitation requires the wiki to be open to registration and the XWiki.Registration page to be forbidden for guests (or equivalent rights); administrators e...

Remote code execution in xwiki-platform

Impact It's possible for an unprivileged user to perform a remote code execution by injecting a groovy script in her own profile and by calling the Reset password feature since the feature is performing a save of the user profile with programming rights in the impacted versions of XWiki. Patches...

GHSA-MGJW-2WRP-R535 Remote code execution in xwiki-platform

Impact It's possible for an unprivileged user to perform a remote code execution by injecting a groovy script in her own profile and by calling the Reset password feature since the feature is performing a save of the user profile with programming rights in the impacted versions of XWiki. Patches...

CVE-2022-23621 Missing authorization in xwiki-platform

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with SCRIPT right can read any file located in the XWiki WAR for example xwiki.cfg and xwiki.properties through XWikiinvokeServletAndReturnAsString as...

CVE-2022-23621 Missing authorization in xwiki-platform

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with SCRIPT right can read any file located in the XWiki WAR for example xwiki.cfg and xwiki.properties through XWikiinvokeServletAndReturnAsString as...