Design/Logic Flaw

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user who can create a space can become admin of that space through App Within Minutes. The admin right implies the script right and thus allows JavaScript injection. The vulnerability can ...

Design/Logic Flaw

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. If guest has view right on any document. It's possible to create a new user using the distribution/firstadminuser.wiki in the wrong context. This vulnerability has been patched in XWiki...

Code injection

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible to display or interact with any page a user cannot access through the combination of the async and display macros. A comment with either macro will be execut...

CVE-2023-29517 Exposure of Sensitive Information to an Unauthorized Actor in org.xwiki.platform:xwiki-platform-office-viewer

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The office document viewer macro was allowing anyone to see any file content from the hosting server, provided that the office server was connected and depending on the permissions of the user...

CVE-2023-29517 Exposure of Sensitive Information to an Unauthorized Actor in org.xwiki.platform:xwiki-platform-office-viewer

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The office document viewer macro was allowing anyone to see any file content from the hosting server, provided that the office server was connected and depending on the permissions of the user...

CVE-2023-29517

CVE-2023-29517 affects XWiki Platform, where the office document viewer macro could disclose any file on the host and trigger internal requests, depending on the servlet user’s permissions. Root cause: insecure access via the office viewer macro enabling information disclosure. Affected versions ...

CVE-2023-29517 Exposure of Sensitive Information to an Unauthorized Actor in org.xwiki.platform:xwiki-platform-office-viewer

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The office document viewer macro was allowing anyone to see any file content from the hosting server, provided that the office server was connected and depending on the permissions of the user...

CVE-2023-29516 Code injection from view right on XWiki.AttachmentSelector in xwiki-platform

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with view rights on XWiki.AttachmentSelector can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is imprope...

CVE-2023-29516

CVE-2023-29516 – XWiki Platform vulnerability where any user with view rights on the XWiki.AttachmentSelector can execute arbitrary Groovy, Python or Velocity code, granting full access to the installation. Root cause: improper escaping in the ancel and return to pageutton. Affected versions pa...

CVE-2023-29516 Code injection from view right on XWiki.AttachmentSelector in xwiki-platform

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with view rights on XWiki.AttachmentSelector can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is imprope...

CVE-2023-29516 Code injection from view right on XWiki.AttachmentSelector in xwiki-platform

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with view rights on XWiki.AttachmentSelector can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is imprope...

CVE-2023-29515 Cross-site scripting (XSS) in xwiki-platform

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user who can create a space can become admin of that space through App Within Minutes. The admin right implies the script right and thus allows JavaScript injection. The vulnerability can ...

CVE-2023-29515

CVE-2023-29515 affects XWiki Platform. The flaw allows a user who can create a space to become the space admin via the App Within Minutes (AWM) feature, granting the script right and enabling JavaScript injection. Exploitation involves creating an AWM app; alternatively, the app can be created di...

CVE-2023-29515 Cross-site scripting (XSS) in xwiki-platform

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user who can create a space can become admin of that space through App Within Minutes. The admin right implies the script right and thus allows JavaScript injection. The vulnerability can ...

CVE-2023-29515 Cross-site scripting (XSS) in xwiki-platform

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user who can create a space can become admin of that space through App Within Minutes. The admin right implies the script right and thus allows JavaScript injection. The vulnerability can ...

CVE-2023-29514

XWiki Platform is affected by a Code Injection vulnerability in the template provider administration (CVE-2023-29514). Any user with edit rights on a document can execute code with programming rights, enabling remote code execution. Red Hat, OSV, CVE listings and OpenVAS/third-party advisories co...

CVE-2023-29514 Code injection in template provider administration in xwiki-platform

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with edit rights on any document e.g., their own user profile can execute code with programming rights, leading to remote code execution. This vulnerability has been patched in XWiki...

CVE-2023-29514 Code injection in template provider administration in xwiki-platform

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with edit rights on any document e.g., their own user profile can execute code with programming rights, leading to remote code execution. This vulnerability has been patched in XWiki...

CVE-2023-29514 Code injection in template provider administration in xwiki-platform

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with edit rights on any document e.g., their own user profile can execute code with programming rights, leading to remote code execution. This vulnerability has been patched in XWiki...

CVE-2023-29513 Users can be created even when registration is disabled without validation via the template macro in xwiki-platform

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. If guest has view right on any document. It's possible to create a new user using the distribution/firstadminuser.wiki in the wrong context. This vulnerability has been patched in XWiki...