CVE-2023-29513 Users can be created even when registration is disabled without validation via the template macro in xwiki-platform

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. If guest has view right on any document. It's possible to create a new user using the distribution/firstadminuser.wiki in the wrong context. This vulnerability has been patched in XWiki...

CVE-2023-29513

XWiki Platform (CVE-2023-29513) allows an attacker to create a new user if a guest has view rights on any document, by exploiting the distribution/firstadminuser.wiki in the wrong context. Root cause: improper handling of guest access combined with the template macro enables user registration whe...

CVE-2023-29513 Users can be created even when registration is disabled without validation via the template macro in xwiki-platform

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. If guest has view right on any document. It's possible to create a new user using the distribution/firstadminuser.wiki in the wrong context. This vulnerability has been patched in XWiki...

CVE-2023-29512 Code injection in xwiki-platform-web-templates

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with edit rights on a page e.g., it's own user page, can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is...

CVE-2023-29512

CVE-2023-29512 affects XWiki Platform. The issue is a code injection vulnerability where an ordinary user with edit rights can execute arbitrary Groovy, Python, or Velocity code due to improper escaping of information loaded from attachments in imported.vm, importinline.vm, and packagelist.vm, po...

CVE-2023-29512 Code injection in xwiki-platform-web-templates

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with edit rights on a page e.g., it's own user page, can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is...

CVE-2023-29512 Code injection in xwiki-platform-web-templates

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with edit rights on a page e.g., it's own user page, can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is...

CVE-2023-29510 Code injection via unescaped translations in xwiki-platform

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In XWiki, every user can add translations that are only applied to the current user. This also allows overriding existing translations. Such translations are often included in privileged...

CVE-2023-29510 Code injection via unescaped translations in xwiki-platform

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In XWiki, every user can add translations that are only applied to the current user. This also allows overriding existing translations. Such translations are often included in privileged...

CVE-2023-29510 Code injection via unescaped translations in xwiki-platform

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In XWiki, every user can add translations that are only applied to the current user. This also allows overriding existing translations. Such translations are often included in privileged...

CVE-2023-29510

CVE-2023-29510 is a code injection/remote execution vulnerability in XWiki Platform caused by unescaped user-scoped translations that can be injected in privileged contexts. The issue allows remote code execution for users with edit access on at least one document (potentially their own profile)....

CVE-2023-29522 Code injection from view right on XWiki.ClassSheet in xwiki-platform

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with view rights can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki...

CVE-2023-29522 Code injection from view right on XWiki.ClassSheet in xwiki-platform

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with view rights can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki...

CVE-2023-29522 Code injection from view right on XWiki.ClassSheet in xwiki-platform

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with view rights can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki...

CVE-2023-29522

CVE-2023-29522 affects XWiki Platform. Any user with view rights can execute arbitrary script macros (Groovy/Python) that enable remote code execution and unrestricted read/write access to wiki contents. The attack is triggered by opening a non-existing page whose name contains a dangerous payloa...

CVE-2023-29521 Code injection from account/view through VFS Tree macro in xwiki-platform

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with view rights can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of...

CVE-2023-29521 Code injection from account/view through VFS Tree macro in xwiki-platform

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with view rights can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of...

CVE-2023-29521

CVE-2023-29521 affects XWiki Platform. A vulnerability in the Macro.VFSTreeMacro allows any user with view rights to execute arbitrary Groovy, Python or Velocity code, granting full access to the XWiki installation. Root cause: improper escaping of the VFSTreeMacro. The page is not installed by d...

CVE-2023-29521 Code injection from account/view through VFS Tree macro in xwiki-platform

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with view rights can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of...

CVE-2023-29520

CVE-2023-29520 affects XWiki Platform. A corrupted document containing a translation object can break translations on wiki pages, leading to a broken page. Patches are available in XWiki 15.0-rc-1, 14.10.1, 14.4.8, and 13.10.11; upgrading is advised. There are no workarounds beyond fixing the doc...