Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
5 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact XWiki discovered that the patch for GHSA-5cf8-vrr8-8hjm was insufficient and with slightly modified parameters to the LiveTableResults, it is still possible to discover password hashes one bit at a time, so with 768 requests, the full password salt and hash can be retrieved of a user. Patches The check for password (and email properties) has been adjusted in XWiki 18.0.0RC1, 17.10.13, 17.4.9 and 16.10.17. Workarounds The patch can be applied manually to the wiki page XWiki.LiveTableResultsMacros. Resources https://jira.xwiki.org/browse/XWIKI-23875 https://github.com/xwiki/xwiki-platform/commit/c4442716b02ffcdaa9d5e703b1db6203e36456fa
Recommended action: Upgrade to 17.10.3, 17.4.9 or 16.10.17 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The mail obfuscation configuration was not fully taken into account and is was still possible by obfuscated emails. See https://jira.xwiki.org/browse/XWIKI-20601 for the reproduction steps. Patches This has been patched in XWiki 14.10.9, and XWiki 15.3-rc-1. Workarounds The workaround is to modify the page XWiki.LiveTableResultsMacros following this patch. References - https://jira.xwiki.org/browse/XWIKI-20601 - https://github.com/xwiki/xwiki-platform/commit/1dfb6804d4d412794cbe0098d4972b8ac263df0c For more information If you have any questions or comments about this advisory: - Open an issue in Jira XWiki.org - Email us at Security Mailing List
Recommended action: Upgrade to 15.3-rc-1 (pre-release) or 14.10.9 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The mail obfuscation configuration was not fully taken into account and while the mail displayed to the end user was obfuscated: - the rest response was also containing the mail unobfuscated - user were able to filter and sort on the unobfuscated (allowing to infer the mail content) The consequence was the possibility to retrieve the email addresses of all users even when obfuscated. See https://jira.xwiki.org/browse/XWIKI-20333 for the reproduction steps. Patches This has been patched in XWiki 14.10.4, XWiki 14.4.8, and XWiki 15.0-rc-1. Workarounds The workaround is to modify the page XWiki.LiveTableResultsMacros following this patch. References https://jira.xwiki.org/browse/XWIKI-20333 For more information If you have any questions or comments about this advisory: Open an issue in Jira XWiki.org Email us at Security Mailing List Attribution This vulnerability has been reported on Intigriti by @floerer
Recommended action: Upgrade to 14.10.4 or 14.4.8 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Users can deduce the content of the password fields by repeated call to LiveTableResults and WikisLiveTableResultsMacros. Patches The issue is applied on versions 14.7-rc-1, 13.4.4, and 13.10.9. Workarounds The issue can be fixed by upgrading to versions 14.7-rc-1, 13.4.4, and 13.10.9 and higher, or in version = 3.2M3 by applying the patch manually on LiveTableResults and WikisLiveTableResultsMacros. References - Jira: https://jira.xwiki.org/browse/XWIKI-19949 - Patch: https://github.com/xwiki/xwiki-platform/commit/7f8825537c9523ccb5051abd78014d156f9791c8 For more information If you have any questions or comments about this advisory: - Open an issue in Jira XWiki.org - Email us at Security Mailing List
Recommended action: Upgrade to 14.7-rc-1 (pre-release), 13.10.9 or 13.4.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact User without the right to view documents can deduce their existence by repeated Livetable queries. Reproduction steps 1. Restrict "view" access to Sandbox.TestPage3 by setting an explicit view right for admins 1. As a user who is not an admin, open <server/bin/get/XWiki/LiveTableResults?outputSyntax=plain&classname=&collist=doc.title%2Cdoc.location%2Cdoc.content&doc.title=Sandbo&doc.location=Sandbox.TestPage3&doc.content=dummy&limit=0 where <server is the URL of your XWiki installation. Expect Result: No results are displayed as the user doesn't have view rights on Sandbox.TestPage3. Actual Result: The result is displayed. This reveals that a document Sandbox.TestPage3 exists (we explicitly searched for this name) which has a title containing "Sandbo" and a content containing "dummy". By starting with a single letter and then iteratively extending the match, the full content of the title/content or XObject properties can be discovered. Several tests can be combined in a single…
Recommended action: Upgrade to 14.6-rc-1 (pre-release), 14.4.3 or 13.10.8 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.