Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact The Blog Application is vulnerable to Stored Cross-Site Scripting (XSS) via the Blog Post Title. The vulnerability arises because the post title is injected directly into the HTML <title tag without proper escaping. An attacker with permissions to create or edit blog posts can inject malicious JavaScript into the title field. This script will execute in the browser of any user (including administrators) who views the blog post. This leads to potential session hijacking or privilege escalation. To reproduce: Log in as a user with rights to create blog posts. Create a new blog post. In the Title field, insert the following payload designed to break out of the title tag: Save (Publish) the post. View the post in the blog home page Patches The vulnerability has been patched in the blog application version 9.15.7 by adding missing escaping. Workarounds We're not aware of any workarounds. References https://jira.xwiki.org/browse/BLOG-245…
Recommended action: Upgrade to 9.15.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The blog application in XWiki allowed remote code execution for any user who has edit right on any page. Normally, these are all logged-in users as they can edit their own user profile. To exploit, it is sufficient to add an object of type Blog.BlogPostClass to any page and to add some script macro with the exploit code to the "Content" field of that object. Patches The vulnerability has been patched in the blog application version 9.14 by executing the content of blog posts with the rights of the appropriate author. Workarounds We're not aware of any workarounds. Resources https://jira.xwiki.org/browse/BLOG-191 https://github.com/xwiki-contrib/application-blog/commit/b98ab6f17da3029576f42d12b4442cd555c7e0b4
Recommended action: Upgrade to 9.14 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.