Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
4 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact Any user with the right to add an object on a page can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of the styles properties FlamingoThemesCode.WebHome. This page is installed by default. Reproduction Steps Steps to reproduce: - As a user without script or programming rights, edit your user profile with the object editor (enable advanced mode if necessary to get access) and add an object of type "Theme Class" of "FlamingoThemesCode". In the field "body-bg" (all other fields should work, too) add the following text: {{/html}} {{async async="true" cached="false" context="doc.reference"}}{{groovy}}println("Hello " + "from groovy!"){{/groovy}}{{/async}} - Click "Save & View" - Open <xwiki-host/xwiki/bin/view/FlamingoThemesCode/WebHomeSheet where <xwiki-host is the URL of your XWiki installation Expected result: The list of color themes either doesn't include the user's profile or…
Recommended action: Upgrade to 14.10, 14.4.7 or 13.10.11 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Any user with view rights on commonly accessible documents can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of the documentTree macro parameters in This macro is installed by default in FlamingoThemesCode.WebHome. This page is installed by default. Example of reproduction: Open <xwikihost/xwiki/bin/view/%22%20%2F%7D%7D%20%7B%7Basync%20async%3D%22true%22%20cached%3D%22false%22%20context%3D%22doc.reference%22%7D%7D%7B%7Bgroovy%7D%7Dprintln(%22Hello%20%22%20%2B%20%22from%20groovy!%22)%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fasync%7D%7D?sheet=FlamingoThemesCode.WebHome&xpage=view where <xwikihost is the URL of your XWiki installation. The [documentTree] macro is a standalone macro and it cannot be used inline. Click on this message for details. Hello from groovy!.WebHome" /}} is displayed. This shows that the Groovy macro that is passed in the URL has been executed and thus demonstrates a…
Recommended action: Upgrade to 14.10, 14.4.7 or 13.10.11 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact It's possible to inject arbitrary wiki syntax including Groovy, Python and Velocity script macros via the newThemeName request parameter (URL parameter), in combination with additional parameters formtoken=1&action=create. For instance: http://127.0.0.1:8080/xwiki/bin/view/FlamingoThemesCode/WebHomeSheet?newThemeName=foo%22%2F%7D%7D%7B%7Basync%20async%3D%22true%22%20cached%3D%22false%22%20context%3D%22doc.reference%22%7D%7D%7B%7Bgroovy%7D%7Dprintln(%22hello%20from%20groovy!%22)%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fasync%7D%7D&formtoken=1&action=create%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fasync%7D%7D&formtoken=1&action=create) will execute the following groovy code: println("hello from groovy!") on the server. Patches This has been patched in the supported versions 13.10.10, 14.9-rc-1, and 14.4.6. Workarounds It is possible to edit FlamingoThemesCode.WebHomeSheet and manually perform the changes from the patch fixing the issue. References -…
Recommended action: Upgrade to 14.9-rc-1 (pre-release), 14.4.6 or 13.10.10 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact We found a possible XSS vector in the FlamingoThemesCode.WebHomeSheet wiki page related to the "newThemeName" form field. Patches The issue is patched in versions 12.10.11, 14.0-rc-1, 13.4.7, 13.10.3. Workarounds The easiest workaround is to edit the wiki page FlamingoThemesCode.WebHomeSheet (with wiki editor) and change the line into References https://jira.xwiki.org/browse/XWIKI-19294 https://github.com/xwiki/xwiki-platform/commit/bd935320bee3c27cf7548351b1d0f935f116d437 For more information If you have any questions or comments about this advisory: Open an issue in Jira XWiki Email us at security mailing list
Recommended action: Upgrade to 13.10.3, 13.4.7 or 12.10.11 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.