7 matches found
CVE-2023-50721
XWiki Platform is a generic wiki platform. Starting in 4.5-rc-1 and prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, the search administration interface doesn't properly escape the id and label of search user interface extensions, allowing the injection of XWiki syntax containing script macros...
CVE-2023-50721
XWiki Platform is a generic wiki platform. Starting in 4.5-rc-1 and prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, the search administration interface doesn't properly escape the id and label of search user interface extensions, allowing the injection of XWiki syntax containing script macros...
Remote code execution
XWiki Platform is a generic wiki platform. Starting in 4.5-rc-1 and prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, the search administration interface doesn't properly escape the id and label of search user interface extensions, allowing the injection of XWiki syntax containing script macros...
CVE-2023-50721
XWiki Platform is a generic wiki platform. Starting in 4.5-rc-1 and prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, the search administration interface doesn't properly escape the id and label of search user interface extensions, allowing the injection of XWiki syntax containing script macros...
CVE-2023-50721
The connected Red Hat advisory confirms CVE-2023-50721 as an RCE in XWiki Platform. The vulnerability arises from improper escaping of the id and label of search UI extensions in the search administration interface, enabling injection of XWikiScript (including Groovy) that can execute remotely. I...
PT-2023-8223
Name of the Vulnerable Software and Affected Versions XWiki Platform versions 4.5-rc-1 through 14.10.14 XWiki Platform versions 14.10.15 through 15.5.1 XWiki Platform versions 15.5.2 through 15.7-rc-1 Description The search administration interface doesn't properly escape the id and label of sear...
CVE-2023-50721: Improper Neutralization of Directives in Dynamically Evaluated Code
XWiki Platform is a generic wiki platform. Starting in 4.5-rc-1 and prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, the search administration interface doesn't properly escape the id and label of search user interface extensions, allowing the injection of XWiki syntax containing script macros...