Xwiki Xwiki-Platform vulnerabilities

CVE-2022-23618 [MEDIUM] CWE-601 CVE-2022-23618: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions there is no protection against URL redirection to untrusted sites, in particular some well known parameters (xredirect) can be used to perform url redirections. This problem has been patched in XWiki 12.10.7 and XWiki 13.3RC1

CVE-2023-26480 [MEDIUM] CWE-79 CVE-2023-26480: XWiki Platform is a generic wiki platform. Starting in version 12.10, a user without script rights c XWiki Platform is a generic wiki platform. Starting in version 12.10, a user without script rights can introduce a stored cross-site scripting by using the Live Data macro. This has been patched in XWiki 14.9, 14.4.7, and 13.10.10. There are no known workarounds.

CVE-2021-21379 [MEDIUM] CWE-281 CVE-2021-21379: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions of XWiki Platform, the `{{wikimacrocontent}}` executes the content with the rights of the wiki macro author instead of the caller of that wiki macro. This makes possible to inject scripts through it and they will be executed

CVE-2022-41932 [MEDIUM] CWE-400 CVE-2022-41932: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to make XWiki create many new schemas and fill them with tables just by using a crafted user identifier in the login form. This may lead to degraded database performance. The problem has been patched in XWiki 13.10.8, 14.6RC1 and 14

CVE-2022-23622 [MEDIUM] CWE-79 CVE-2022-23622: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions there is a cross site scripting (XSS) vector in the `registerinline.vm` template related to the `xredirect` hidden field. This template is only used in the following conditions: 1. The wiki must be open to registration for any

CVE-2022-29252 [MEDIUM] CWE-80 CVE-2022-29252: XWiki Platform Wiki UI Main Wiki is a package for managing subwikis. Starting with version 5.3-miles XWiki Platform Wiki UI Main Wiki is a package for managing subwikis. Starting with version 5.3-milestone-2, XWiki Platform Wiki UI Main Wiki contains a possible cross-site scripting vector in the `WikiManager.JoinWiki ` wiki page related to the "requestJoin" field. The issue is patched in versions 12.10.11, 14.0-rc-1, 13.4.7, and 13.10.3. The easiest

CVE-2023-36477 [MEDIUM] CWE-79 CVE-2023-36477: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with edit rights can edit all pages in the `CKEditor' space. This makes it possible to perform a variety of harmful actions, such as removing technical documents, leading to loss of service and editing the javascript configuration of CKEd

CVE-2023-45137 [MEDIUM] CWE-79 CVE-2023-45137: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. `org.xwiki.platform:xwiki-platform-web` starting in version 3.1-milestone-2 and prior to version 13.4-rc-1, as well as `org.xwiki.platform:xwiki-platform-web-templates` prior to versions 14.10.12 and 15.5-rc-1, are vulnerable to cross-site scripti

CVE-2023-29515 [MEDIUM] CWE-79 CVE-2023-29515: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user who can create a space can become admin of that space through App Within Minutes. The admin right implies the script right and thus allows JavaScript injection. The vulnerability can be exploited by creating an app in App Within Minutes.

CVE-2023-29203 [MEDIUM] CWE-359 CVE-2023-29203: XWiki Commons are technical libraries common to several other top level XWiki projects. It's possibl XWiki Commons are technical libraries common to several other top level XWiki projects. It's possible to list some users who are normally not viewable from subwiki by requesting users on a subwiki which allows only global users with `uorgsuggest.vm`. This issue only concerns hidden users from main wiki. Note that the disclosed information are the us

CVE-2024-31985 [MEDIUM] CWE-352 CVE-2024-31985: XWiki Platform is a generic wiki platform. Starting in version 3.1 and prior to versions 4.10.20, 15 XWiki Platform is a generic wiki platform. Starting in version 3.1 and prior to versions 4.10.20, 15.5.4, and 15.10-rc-1, it is possible to schedule/trigger/unschedule existing jobs by having an admin visit the Job Scheduler page through a predictable URL, for example by embedding such an URL in any content as an image. The vulnerability has been fi

CVE-2022-23621 [MEDIUM] CWE-862 CVE-2022-23621: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with SCRIPT right can read any file located in the XWiki WAR (for example xwiki.cfg and xwiki.properties) through XWiki#invokeServletAndReturnAsString as `$xwiki.invokeServletAndReturnAsString("/WEB-INF/xwiki.cfg")`.

CVE-2024-31464 [MEDIUM] CWE-200 CVE-2024-31464: XWiki Platform is a generic wiki platform. Starting in version 5.0-rc-1 and prior to versions 14.10. XWiki Platform is a generic wiki platform. Starting in version 5.0-rc-1 and prior to versions 14.10.19, 15.5.4, and 15.9-rc-1, it is possible to access the hash of a password by using the diff feature of the history whenever the object storing the password is deleted. Using that vulnerability it's possible for an attacker to have access to the hash

CVE-2022-23620 [MEDIUM] CWE-22 CVE-2022-23620: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions AbstractSxExportURLFactoryActionHandler#processSx does not escape anything from SSX document references when serializing it on filesystem, it is possible to for the HTML export process to contain reference elements containing

CVE-2023-29206 [MEDIUM] CWE-79 CVE-2023-29206: XWiki Commons are technical libraries common to several other top level XWiki projects. There was no XWiki Commons are technical libraries common to several other top level XWiki projects. There was no check in the author of a JavaScript xobject or StyleSheet xobject added in a XWiki document, so until now it was possible for a user having only Edit Right to create such object and to craft a script allowing to perform some operations when executing

CVE-2023-35153 [MEDIUM] CWE-79 CVE-2023-35153: XWiki Platform is a generic wiki platform. Starting in version 5.4.4 and prior to versions 14.4.8, 1 XWiki Platform is a generic wiki platform. Starting in version 5.4.4 and prior to versions 14.4.8, 14.10.4, and 15.0, a stored cross-site scripting vulnerability can be exploited by users with edit rights by adding a `AppWithinMinutes.FormFieldCategoryClass` class on a page and setting the payload on the page title. Then, any user visiting `/xwiki/bi

CVE-2023-29205 [MEDIUM] CWE-79 CVE-2023-29205: XWiki Commons are technical libraries common to several other top level XWiki projects. The HTML mac XWiki Commons are technical libraries common to several other top level XWiki projects. The HTML macro does not systematically perform a proper neutralization of script-related html tags. As a result, any user able to use the html macro in XWiki, is able to introduce an XSS attack. This can be particularly dangerous since in a standard wiki, any user

CVE-2023-29508 [MEDIUM] CWE-79 CVE-2023-29508: XWiki Commons are technical libraries common to several other top level XWiki projects. A user witho XWiki Commons are technical libraries common to several other top level XWiki projects. A user without script rights can introduce a stored XSS by using the Live Data macro, if the last author of the content of the page has script rights. This has been patched in XWiki 14.10, 14.4.7, and 13.10.11.

CVE-2022-41929 [MEDIUM] CWE-862 CVE-2022-41929: org.xwiki.platform:xwiki-platform-oldcore is missing authorization in User#setDisabledStatus, which org.xwiki.platform:xwiki-platform-oldcore is missing authorization in User#setDisabledStatus, which may allow an incorrectly authorized user with only Script rights to enable or disable a user. This operation is meant to only be available for users with admin rights. This problem has been patched in XWiki 13.10.7, 14.4.2 and 14.5RC1.

CVE-2023-38509 [MEDIUM] CWE-402 CVE-2023-38509: XWiki Platform is a generic wiki platform. In org.xwiki.platform:xwiki-platform-livetable-ui startin XWiki Platform is a generic wiki platform. In org.xwiki.platform:xwiki-platform-livetable-ui starting with version 3.5-milestone-1 and prior to versions 14.10.9 and 15.3-rc-1, the mail obfuscation configuration was not fully taken into account and is was still possible by obfuscated emails. This has been patched in XWiki 14.10.9 and XWiki 15.3-rc-1.