XWiki < 14.10.9, 15.0-rc-1 < 15.4 Improper Access Control Vulnerability (GHSA-8xhr-x3v8-rghj)

XWiki is prone to an improper access control vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:xwiki:xwiki";...

CVE-2023-40573

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki supports scheduled jobs that contain Groovy scripts. Currently, the job checks the content author of the job for programming right. However, modifying or adding a job script to a documen...

CVE-2023-40572

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The create action is vulnerable to a CSRF attack, allowing script and thus remote code execution when targeting a user with script/programming right, thus compromising the confidentiality,...

Cross site request forgery (csrf)

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki supports scheduled jobs that contain Groovy scripts. Currently, the job checks the content author of the job for programming right. However, modifying or adding a job script to a documen...

Cross site request forgery (csrf)

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The create action is vulnerable to a CSRF attack, allowing script and thus remote code execution when targeting a user with script/programming right, thus compromising the confidentiality,...

CVE-2023-40573 XWiki Platform's Groovy jobs check the wrong author, allowing remote code execution

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki supports scheduled jobs that contain Groovy scripts. Currently, the job checks the content author of the job for programming right. However, modifying or adding a job script to a documen...

CVE-2023-40573

CVE-2023-40573 affects XWiki Platform’s Groovy job scheduler. The vulnerability arises because the system validates the content author for programming rights on scheduled Groovy jobs, while modifications to a job script on a document do not update the author, enabling an attacker with edit rights...

CVE-2023-40573 XWiki Platform's Groovy jobs check the wrong author, allowing remote code execution

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki supports scheduled jobs that contain Groovy scripts. Currently, the job checks the content author of the job for programming right. However, modifying or adding a job script to a documen...

CVE-2023-40573 XWiki Platform's Groovy jobs check the wrong author, allowing remote code execution

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki supports scheduled jobs that contain Groovy scripts. Currently, the job checks the content author of the job for programming right. However, modifying or adding a job script to a documen...

CVE-2023-40572 XWiki Platform vulnerable to CSRF privilege escalation/RCE via the create action

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The create action is vulnerable to a CSRF attack, allowing script and thus remote code execution when targeting a user with script/programming right, thus compromising the confidentiality,...

CVE-2023-40572

XWiki Platform is vulnerable to a CSRF-based privilege escalation leading to remote code execution via the create action when a user with script rights visits a crafted image. The issue arises because the create action can be triggered without a CSRF token, enabling script execution and compromis...

CVE-2023-40572 XWiki Platform vulnerable to CSRF privilege escalation/RCE via the create action

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The create action is vulnerable to a CSRF attack, allowing script and thus remote code execution when targeting a user with script/programming right, thus compromising the confidentiality,...

XWiki 4.1-milestone-2 < 14.10.5 XSS Vulnerability (GHSA-h8cm-3v5f-rgp6)

XWiki is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:xwiki:xwiki";...

XWiki 4.3-milestone-2 < 14.10.5 Privilege Escalation Vulnerability (GHSA-5mf8-v43w-mfxp)

XWiki is prone to a privilege escalation vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:xwiki:xwiki"; ifdescripti...

XWiki Platform 跨站请求伪造漏洞

XWiki Platform is a suite of Wiki platforms from the XWiki Foundation in France for creating collaborative Web applications. XWiki Platform is vulnerable to a cross-site request forgery vulnerability that stems from the presence of a cross-site request forgery CSRF vulnerability. An attacker coul...

XWiki Platform 访问控制错误漏洞

XWiki Platform is a suite of Wiki platforms for creating Web collaboration applications from the XWiki Foundation in France. XWiki Platform suffers from an Access Control Error vulnerability that stems from a security flaw in Groovy job checking. The vulnerability can be exploited by an attacker...

CVE-2023-40177

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any registered user can use the content field of their user profile page to execute arbitrary scripts with programming rights, thus effectively performing rights escalation. This issue is...

Privilege escalation

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any registered user can use the content field of their user profile page to execute arbitrary scripts with programming rights, thus effectively performing rights escalation. This issue is...

GHSA-8XHR-X3V8-RGHJ XWiki Platform's Groovy jobs check the wrong author, allowing remote code execution

Impact XWiki supports scheduled jobs that contain Groovy scripts. Currently, the job checks the content author of the job for programming right. However, modifying or adding a job script to a document doesn't modify the content author. Together with a CSRF vulnerability in the job scheduler, this...

XWiki Platform's Groovy jobs check the wrong author, allowing remote code execution

Impact XWiki supports scheduled jobs that contain Groovy scripts. Currently, the job checks the content author of the job for programming right. However, modifying or adding a job script to a document doesn't modify the content author. Together with a CSRF vulnerability in the job scheduler, this...