CVE-2023-50723

CVE-2023-50723 affects XWiki Platform, a generic wiki platform. The vulnerability arises from missing escaping in the code that displays sections in the administration interface, allowing a user who can edit any wiki page to gain programming rights. Affected versions are 2.3 up to before fixes: 1...

CVE-2023-50723 XWiki Platform remote code execution/programming rights with configuration section from any user account

XWiki Platform is a generic wiki platform. Starting in 2.3 and prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, anyone who can edit an arbitrary wiki page in an XWiki installation can gain programming right through several cases of missing escaping in the code for displaying sections in the...

CVE-2023-50723 XWiki Platform remote code execution/programming rights with configuration section from any user account

XWiki Platform is a generic wiki platform. Starting in 2.3 and prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, anyone who can edit an arbitrary wiki page in an XWiki installation can gain programming right through several cases of missing escaping in the code for displaying sections in the...

CVE-2023-50723 XWiki Platform remote code execution/programming rights with configuration section from any user account

XWiki Platform is a generic wiki platform. Starting in 2.3 and prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, anyone who can edit an arbitrary wiki page in an XWiki installation can gain programming right through several cases of missing escaping in the code for displaying sections in the...

CVE-2023-50722

CVE-2023-50722 affects XWiki Platform. A reflected XSS or remote code execution exists in the display logic for configurable admin sections, exploitable when an admin visits a crafted URL. Affected versions are prior to 14.10.15, 15.5.2, and 15.7-rc-1. The issue allows full remote code execution ...

CVE-2023-50722 XWiki Platform XSS/CSRF Remote Code Execution in XWiki.ConfigurableClass

XWiki Platform is a generic wiki platform. Starting in 2.3 and prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, there is a reflected XSS or also direct remote code execution vulnerability in the code for displaying configurable admin sections. The code that can be passed through a URL parameter...

CVE-2023-50722 XWiki Platform XSS/CSRF Remote Code Execution in XWiki.ConfigurableClass

XWiki Platform is a generic wiki platform. Starting in 2.3 and prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, there is a reflected XSS or also direct remote code execution vulnerability in the code for displaying configurable admin sections. The code that can be passed through a URL parameter...

CVE-2023-50721

The connected Red Hat advisory confirms CVE-2023-50721 as an RCE in XWiki Platform. The vulnerability arises from improper escaping of the id and label of search UI extensions in the search administration interface, enabling injection of XWikiScript (including Groovy) that can execute remotely. I...

CVE-2023-50721 XWiki Platform RCE from account through SearchAdmin

XWiki Platform is a generic wiki platform. Starting in 4.5-rc-1 and prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, the search administration interface doesn't properly escape the id and label of search user interface extensions, allowing the injection of XWiki syntax containing script macros...

CVE-2023-50721 XWiki Platform RCE from account through SearchAdmin

XWiki Platform is a generic wiki platform. Starting in 4.5-rc-1 and prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, the search administration interface doesn't properly escape the id and label of search user interface extensions, allowing the injection of XWiki syntax containing script macros...

CVE-2023-50719 XWiki Platform Solr search discloses password hashes of all users

XWiki Platform is a generic wiki platform. Starting in 7.2-milestone-2 and prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, the Solr-based search in XWiki discloses the password hashes of all users to anyone with view right on the respective user profiles. By default, all user profiles are...

CVE-2023-50719

XWiki Platform’s Solr-based search discloses password hashes (and potentially API keys stored as passwords) of all users to anyone with view rights on the user profile. Affected versions are 7.2-milestone-2 through prior to 14.10.15, 15.5.2, and 15.7-rc-1. By default, user profiles are public, en...

CVE-2023-50719 XWiki Platform Solr search discloses password hashes of all users

XWiki Platform is a generic wiki platform. Starting in 7.2-milestone-2 and prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, the Solr-based search in XWiki discloses the password hashes of all users to anyone with view right on the respective user profiles. By default, all user profiles are...

CVE-2023-50719 XWiki Platform Solr search discloses password hashes of all users

XWiki Platform is a generic wiki platform. Starting in 7.2-milestone-2 and prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, the Solr-based search in XWiki discloses the password hashes of all users to anyone with view right on the respective user profiles. By default, all user profiles are...

CVE-2023-50720 XWiki Platform Solr search discloses email addresses of users

XWiki Platform is a generic wiki platform. Prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, the Solr-based search in XWiki discloses the email addresses of users even when obfuscation of email addresses is enabled. To demonstrate the vulnerability, search for objcontent:email using XWiki's...

CVE-2023-50720 XWiki Platform Solr search discloses email addresses of users

XWiki Platform is a generic wiki platform. Prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, the Solr-based search in XWiki discloses the email addresses of users even when obfuscation of email addresses is enabled. To demonstrate the vulnerability, search for objcontent:email using XWiki's...

CVE-2023-50720

Summary : CVE-2023-50720 affects XWiki Platform. The Solr-based search may disclose user email addresses even when obfuscation is enabled, prior to fixed versions. Affected versions (before fix) : XWiki < 14.10.15, < 15.5.2, and

XWiki Platform Security Vulnerability

XWiki Platform is the XWiki Foundation's suite of Wiki platforms for creating collaborative Web applications. A security vulnerability exists in XWiki Platform that stems from a failure of the search management interface to properly escape the id and label of a search user interface extension,...

XWiki Platform Security Vulnerability

XWiki Platform is the XWiki Foundation's suite of wiki platforms for creating collaborative web applications. A security vulnerability exists in XWiki Platform that stems from the fact that in the administration interface, anyone who can edit any wiki page in an XWiki installation can gain...

XWiki Platform Cross-Site Scripting Vulnerability

XWiki Platform is the XWiki Foundation's suite of Wiki platforms for creating Web collaboration applications. A security vulnerability exists in XWiki Platform that stems from a reflected cross-site scripting vulnerability or a remote code execution vulnerability in the code used to display the...