Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

org.xwiki.commons:xwiki-commons-velocity

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Critical, CVSS 10.0MavenPublished

    XWiki Commons missing escaping of { in Velocity escapetool allows remote code execution

    CVE-2024-31996 · GHSA-hf43-47q4-fhq5

    Affected
    • Maven org.xwiki.commons:xwiki-commons-velocity >= 3.0.1, < 14.10.19; >= 15.0-rc-1, < 15.5.4; >= 15.6-rc-1, < 15.9-rc-1
    Fixed in
    15.9-rc-115.5.414.10.19· Vendor fix available
    Issue
    Impact The HTML escaping of escaping tool that is used in XWiki doesn't escape {, which, when used in certain places, allows XWiki syntax injection and thereby remote code execution. To reproduce in an XWiki installation, open <xwiki-host/xwiki/bin/view/Panels/PanelLayoutUpdate?place=%7B%7B%2Fhtml%7D%7D%7B%7Basync%20async%3Dfalse%7D%7D%7B%7Bvelocity%7D%7D%23evaluate(%24request.eval)%7B%7B%2Fvelocity%7D%7D%7B%7B%2Fasync%7D%7D&eval=Hello%20from%20URL%20Parameter!%20I%20got%20programming%3A%20%24services.security.authorization.hasAccess(%27programming%27) where <xwiki-host is the URL of your XWiki installation. If this displays You are not admin on this place Hello from URL Parameter! I got programming: true, the installation is vulnerable. Patches The vulnerability has been fixed on XWiki 14.10.19, 15.5.5, and 15.9 RC1. Workarounds Apart from upgrading, there is no generic workaround. However, replacing $escapetool.html by $escapetool.xml in XWiki documents fixes the vulnerability. In…

    Recommended action: Upgrade to 15.9-rc-1 (pre-release), 15.5.4 or 14.10.19 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →
  2. High, CVSS 7.5MavenPublished

    Arbitrary filesystem write access from velocity.

    CVE-2022-24897 · GHSA-cvx5-m8vg-vxgc

    Affected
    • Maven org.xwiki.commons:xwiki-commons-velocity >= 2.3.0, < 12.6.7; >= 12.7.0, < 12.10.3
    Fixed in
    12.6.712.10.3· Vendor fix available
    Issue
    Impact The velocity scripts is not properly sandboxed against using the Java File API to perform read or write operations on the filesystem. Now writing an attacking script in velocity requires the Script rights in XWiki so not all users can use it, and it also requires finding an XWiki API which returns a File. Patches The problem has been patched on versions 12.6.7, 12.10.3 and 13.0RC1. Workarounds There's no easy workaround for fixing this vulnerability other than upgrading and being careful when giving Script rights. References https://jira.xwiki.org/browse/XWIKI-5168 For more information If you have any questions or comments about this advisory: Open an issue in Jira XWiki Email us at XWiki Security mailing-list

    Recommended action: Upgrade to 12.10.3 or 12.6.7 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →