Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
6 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact A reflected XSS vulnerability in XWiki allows an attacker to send a victim to a URL with a deletion confirmation message on which the attacker-supplied script is executed when the victim clicks the "No" button. When the victim has admin or programming right, this allows the attacker to execute basically arbitrary actions on the XWiki installation including remote code execution. Patches This vulnerability has been patched in XWiki 16.10.10, 17.4.2 and 17.5.0 by using the affected URL parameter only in the intended context. Workarounds The patch can be manually applied to the templates that are present in the WAR. A restart of XWiki is needed for the changes to be applied.
Recommended action: Upgrade to 17.4.2 or 16.10.10 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact XWiki is vulnerable to reflected cross-site scripting (RXSS) via the rev parameter that is used in the content of the content menu without escaping. If an attacker can convince a user to visit a link with a crafted parameter, this allows the attacker to execute arbitrary actions in the name of the user, including remote code (Groovy) execution in the case of a user with programming right, compromising the confidentiality, integrity and availability of the whole XWiki installation. The vulnerability can be demonstrated by opening <xwiki-host/xwiki/bin/view/Main/?rev=xar%3Aorg.xwiki.platform%3Axwiki-platform-distribution-flavor-common%2F15.5%25%25%22%3e%3cscript%3ealert(1)%3c%2fscript%3e where <xwiki-host is the URL of your XWiki installation. If an alert is displayed, the installation is vulnerable. Patches This has been patched in XWiki 15.6 RC1, 15.5.1 and 14.10.14. Workarounds The patch can be manually applied without upgrading (or restarting) the instance. References…
Recommended action: Upgrade to 15.5.1 or 14.10.14 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). It's possible to exploit the restore template to perform a XSS, e.g. by using URL such as: /xwiki/bin/view/XWiki/Main?xpage=restore&showBatch=true&xredirect=javascript:alert(document.domain) This vulnerability exists since XWiki 9.4-rc-1. Patches The vulnerability has been patched in XWiki 14.10.5 and 15.1-rc-1. Workarounds It's possible to workaround the vulnerability by editing the template restore.vm to perform checks on it, but note that the appropriate fix involves new APIs that have been recently introduced in XWiki. See the referenced jira tickets. References Vulnerability in restore template: https://jira.xwiki.org/browse/XWIKI-20352 Introduction of the macro used for fixing this vulnerability: https://jira.xwiki.org/browse/XWIKI-20583 Commit containing the actual fix in the template: https://github.com/xwiki/xwiki-platform/commit/d5472100606c8355ed44ada273e91df91f682738 For…
Recommended action: Upgrade to 15.1-rc-1 (pre-release) or 14.10.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). It's possible to exploit the delete template to perform a XSS, e.g. by using URL such as: xwiki/bin/get/FlamingoThemes/Cerulean?xpage=xpart&vm=delete.vm&xredirect=javascript:alert(document.domain) This vulnerability exists since XWiki 6.0-rc-1. Patches The vulnerability has been patched in XWiki 14.10.6 and 15.1. Note that a partial patch has been provided in 14.10.5 but wasn't enough to entirely fix the vulnerability. Workarounds It's possible to workaround the vulnerability by editing the template delete.vm to perform checks on it, but note that the appropriate fix involves new APIs that have been recently introduced in XWiki. See the referenced jira tickets. References Jira ticket about the original vulnerability: https://jira.xwiki.org/browse/XWIKI-20341 Commit containing the first fix in the template:…
Recommended action: Upgrade to 15.1 or 14.10.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). It's possible to exploit the previewactions template to perform a XSS, e.g. by using URL such as: <hostname/xwiki/bin/get/FlamingoThemes/Cerulean?xpage=xpart&vm=previewactions.vm&xcontinue=javascript:alert(document.domain) This vulnerability exists since XWiki 6.1-rc-1. Patches The vulnerability has been patched in XWiki 14.10.5 and 15.1-rc-1. Workarounds It's possible to workaround the vulnerability by editing the template previewactions.vm to perform checks on it, but note that the appropriate fix involves new APIs that have been recently introduced in XWiki. See the referenced jira tickets. References Jira ticket about the vulnerability: https://jira.xwiki.org/browse/XWIKI-20342 Introduction of the macro used for fixing this type of vulnerability: https://jira.xwiki.org/browse/XWIKI-20583 Commit containing the actual fix in the template:…
Recommended action: Upgrade to 15.1-rc-1 (pre-release) or 14.10.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The Livetable Macro wasn't properly sanitizing column names, thus allowing the insertion of raw HTML code including JavaScript. This vulnerability was also exploitable via the Documents Macro that is included since XWiki 3.5M1 and doesn't require script rights, this can be demonstrated with the syntax {{documents id="example" count="5" actions="false" columns="doc.title, before<scriptalert(1)</scriptafter"/}}. Therefore, this can also be exploited by users without script right and in comments. With the interaction of a user with more rights, this could be used to execute arbitrary actions in the wiki, including privilege escalation, remote code execution, information disclosure, modifying or deleting content. Patches This has been patched in XWiki 14.9, 14.4.6, and 13.10.10. Workarounds It is possible to apply the patch to existing installations without upgrading. Only the files skins/flamingo/macros.vm and templates/macros.vm in the web application directory need to be…
Recommended action: Upgrade to 14.9, 14.4.6 or 13.10.10 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.