Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact Any user with an account can perform arbitrary remote code execution by adding instances of XWiki.WikiMacroClass to any page. This compromises the confidentiality, integrity and availability of the whole XWiki installation. To reproduce on a instance, as a connected user without script nor programming rights, go to your user profile and add an object of type XWiki.WikiMacroClass. Set "Macro Id", "Macro Name" and "Macro Code" to any value, "Macro Visibility" to Current User and "Macro Description" to {{async}}{{groovy}}println("Hello from User macro!"){{/groovy}}{{/async}}. Save the page, then go to <host/xwiki/bin/view/XWiki/XWikiSyntaxMacrosList. If the description of your new macro reads "Hello from User macro!", then your instance is vulnerable. Patches This vulnerability has been fixed in XWiki 15.10.11, 16.4.1 and 16.5.0. Workarounds It is possible to manually apply this patch to the page XWiki.XWikiSyntaxMacrosList. References https://jira.xwiki.org/browse/XWIKI-22030…
Recommended action: Upgrade to 16.5.0, 16.4.1 or 15.10.11 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact It's possible to execute any wiki content with the right of the TipsPanel author by creating a tip UI extension. To reproduce: Add an object of type UIExtensionClass Set "Extension Point ID" to org.xwiki.platform.help.tipsPanel Set "Extension ID" to org.xwiki.platform.user.test (needs to be unique but otherwise doesn't matter) Set "Extension Parameters" to Set "Extension Scope" to "Current User". Click "Save & View" Open the "Help.TipsPanel" document at <xwiki-host/xwiki/bin/view/Help/TipsPanel where <xwiki-host is the URL of your XWiki installation and press refresh repeatedly. The groovy macro is executed, after the fix you get an error instead. Patches This has been patched in XWiki 15.1-rc-1 and 14.10.5. Workarounds There are no known workarounds for it. References https://jira.xwiki.org/browse/XWIKI-20281 https://github.com/xwiki/xwiki-platform/commit/98208c5bb1e8cdf3ff1ac35d8b3d1cb3c28b3263#diff-4e3467d2ef3871a68b2f910e67cf84531751b32e0126321be83c0f1ed5d90b29L176-R178…
Recommended action: Upgrade to 15.1-rc-1 (pre-release) or 14.10.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.