org.xwiki.platform:xwiki-platform-filter-ui

Open advisories

2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

1. Critical, CVSS 9.6MavenPublished 21 Nov 2022

   Missing Authorization in Filter Stream Converter Application of XWiki-platform

   CVE-2022-41937 · GHSA-q6jp-gcww-8v2j

   Affected

   • Maven org.xwiki.platform:xwiki-platform-filter-ui < 13.10.8; >= 14.0.0, < 14.4.3; >= 14.5.0, < 14.6-rc-1

   Fixed in

   14.6-rc-113.10.814.4.3· Vendor fix available

   Issue

   Impact The application allow anyone with view access to modify any page of the wiki by importing a crafted XAR package. Patches The problem has been patched in XWiki 14.6RC1, 14.6 and 13.10.8. Workarounds The problem can be patched immediately by setting the right of the page Filter.WebHome and making sure only main wiki administrators can VIEW it the application is installed on main wiki or edit the page and apply the changed described on https://github.com/xwiki/xwiki-platform/commit/fb49b4f289ee28e45cfada8e97e320cd3ed27113. References https://github.com/xwiki/xwiki-platform/commit/fb49b4f289ee28e45cfada8e97e320cd3ed27113 https://jira.xwiki.org/browse/XWIKI-19758 For more information If you have any questions or comments about this advisory: Open an issue in JIRA Email us at security ML

   Recommended action: Upgrade to 14.6-rc-1 (pre-release), 14.4.3 or 13.10.8 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

   Sources:github.comSource checked 26 Oct 2026, 16:05 UTCEvidence →
2. High, CVSS 7.4MavenPublished 1 Jun 2022

   Cross-site Scripting in Filter Stream Converter Application in XWiki Platform

   CVE-2022-29258 · GHSA-xjfw-5vv5-vjq2

   Affected

   • Maven org.xwiki.platform:xwiki-platform-filter-ui >= 5.4.4, < 12.10.11; >= 13.0.0, < 13.4.7; >= 13.5.0, < 13.10.3

   Fixed in

   13.10.313.4.712.10.11· Vendor fix available

   Issue

   Impact We found a possible XSS vector in the Filter.FilterStreamDescriptorForm wiki page related to pretty much all the form fields printed in the home page of the application. Patches The issue is patched in versions 12.10.11, 14.0-rc-1, 13.4.7, 13.10.3. Workarounds The easiest workaround is to edit the wiki page Filter.FilterStreamDescriptorForm (with wiki editor) and change the lines into

   Recommended action: Upgrade to 13.10.3, 13.4.7 or 12.10.11 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

   Sources:github.comSource checked 26 Oct 2026, 15:53 UTCEvidence →