CVE-2023-37910 org.xwiki.platform:xwiki-platform-attachment-api vulnerable to Missing Authorization on Attachment Move

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting with the introduction of attachment move support in version 14.0-rc-1 and prior to versions 14.4.8, 14.10.4, and 15.0-rc-1, an attacker with edit access on any document can be the use...

CVE-2023-37910 org.xwiki.platform:xwiki-platform-attachment-api vulnerable to Missing Authorization on Attachment Move

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting with the introduction of attachment move support in version 14.0-rc-1 and prior to versions 14.4.8, 14.10.4, and 15.0-rc-1, an attacker with edit access on any document can be the use...

CVE-2023-37910

CVE-2023-37910 – XWiki Platform : A vulnerability in the attachment move feature allows an attacker with edit access on any document to move any attachment from any document to a document they control. The attacker can access or publish the attachment if they know its name, and the source attachm...

CVE-2023-37910 org.xwiki.platform:xwiki-platform-attachment-api vulnerable to Missing Authorization on Attachment Move

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting with the introduction of attachment move support in version 14.0-rc-1 and prior to versions 14.4.8, 14.10.4, and 15.0-rc-1, an attacker with edit access on any document can be the use...

CVE-2023-37909 Privilege escalation (PR)/remote code execution from account through Menu.UIExtensionSheet

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 5.1-rc-1 and prior to versions 14.10.8 and 15.3-rc-1, any user who can edit their own user profile can execute arbitrary script macros including Groovy and Python macros th...

CVE-2023-37909 Privilege escalation (PR)/remote code execution from account through Menu.UIExtensionSheet

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 5.1-rc-1 and prior to versions 14.10.8 and 15.3-rc-1, any user who can edit their own user profile can execute arbitrary script macros including Groovy and Python macros th...

CVE-2023-37909 Privilege escalation (PR)/remote code execution from account through Menu.UIExtensionSheet

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 5.1-rc-1 and prior to versions 14.10.8 and 15.3-rc-1, any user who can edit their own user profile can execute arbitrary script macros including Groovy and Python macros th...

CVE-2023-37909

CVE-2023-37909 affects XWiki Platform: versions 5.1-rc-1 up to but not including 14.10.8 and 15.3-rc-1 allow any user who can edit their own profile to execute arbitrary script macros (Groovy/Python), enabling remote code execution with full read/write access to wiki content. Root cause is improp...

PT-2023-26178 · Xwiki · Xwiki Platform

Name of the Vulnerable Software and Affected Versions: XWiki Platform versions 5.1-rc-1 through 14.10.7 XWiki Platform versions 15.3-rc-1 and earlier Description: The issue allows any user who can edit their own user profile to execute arbitrary script macros, including Groovy and Python macros,...

XWiki Platform Security Vulnerability

XWiki Platform is a suite of wiki platforms for creating web collaboration applications from the XWiki Foundation in France. A security vulnerability exists in Xwiki versions 9.4-rc-1 through 14.10.8, and versions prior to 15.3-rc-1, which originates when a document is deleted and recreated,...

XWiki Platform Code Injection Vulnerability

XWiki Platform is a suite of Wiki platforms for creating web collaboration applications from the XWiki Foundation in France. A security vulnerability exists in the XWiki Platform that originates from the execution of arbitrary script macros, including Groovy and Python macros that can cause remot...

PT-2023-26180 · Xwiki · Xwiki Platform

Name of the Vulnerable Software and Affected Versions: XWiki Platform versions 9.4-rc-1 through 14.10.7 XWiki Platform versions 15.3-rc-1 and earlier Description: The issue arises when a document has been deleted and re-created, allowing users with view rights on the re-created document but not o...

XWiki Platform Cross-Site Scripting Vulnerability

XWiki Platform is a suite of Wiki platforms for creating web collaboration applications from the XWiki Foundation in France. A security vulnerability exists in XWiki Platform that stems from a cross-site scripting vulnerability...

PT-2023-8615 · Xwiki · Xwiki Platform

Name of the Vulnerable Software and Affected Versions: XWiki Platform versions 14.0-rc-1 through 14.4.7 XWiki Platform versions 14.0-rc-1 through 14.10.3 XWiki Platform versions 14.0-rc-1 through 14.9.x XWiki Platform version 15.0-rc-1 is not affected, but versions prior to it are Description: Th...

XWiki Platform Path Traversal Vulnerability

XWiki Platform is a suite of Wiki platforms for creating Web collaboration applications from the XWiki Foundation in France. A security vulnerability exists in XWiki Platform that stems from the use of specially crafted filenames to trigger an Office converter to allow the contents of an attachme...

PT-2023-8603 · Xwiki · Xwiki Platform +1

Name of the Vulnerable Software and Affected Versions: XWiki Platform versions 7.2-milestone-2 through 14.10.12 org.xwiki.platform:xwiki-platform-web-templates versions prior to 14.10.12 and 15.5-rc-1 Description: The issue allows an attacker to pass a title to the page creation action that isn't...

XWiki Platform Security Vulnerability

XWiki Platform is a suite of Wiki platforms for the creation of collaborative Web applications from the XWiki Foundation in France. A security vulnerability exists in XWiki Platform that stems from the ability to pass a title to a page creation operation that is not initially displayed but is...

XWiki Platform Security Vulnerability

XWiki Platform is a suite of Wiki platforms for creating web collaboration applications from the XWiki Foundation in France. A security vulnerability exists in XWiki Platform that stems from a cross-site scripting vulnerability...

XWiki Platform Security Vulnerability

XWiki Platform is a suite of Wiki platforms from the XWiki Foundation in France for creating collaborative Web applications. A security vulnerability exists in XWiki Platform, which arises from the fact that an attacker with editing privileges on any document can move any attachment from any othe...

XWiki Platform Cross-Site Scripting Vulnerability

XWiki Platform is a suite of Wiki platforms for creating collaborative Web applications from the XWiki Foundation in France. A security vulnerability exists in XWiki Platform that stems from the fact that XWiki is susceptible to a reflective cross-site scripting attack when validating the name of...