Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

org.xwiki.platform:xwiki-platform-localization-source-wiki

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Critical, CVSS 9.9MavenPublished

    XWiki Platform: Remote code execution from edit in multilingual wikis via translations

    CVE-2024-31983 · GHSA-xxp2-9c9g-7wmj

    Affected
    • Maven org.xwiki.platform:xwiki-platform-localization-source-wiki >= 4.3-milestone-2, < 14.10.20; >= 15.0-rc-1, < 15.5.4; >= 15.6-rc-1, < 15.10-rc-1
    Fixed in
    15.10-rc-114.10.2015.5.4· Vendor fix available
    Issue
    Impact In multilingual wikis, translations can be edited by any user who has edit right, circumventing the rights that are normally required for authoring translations (script right for user-scope translations, wiki admin for translations on the wiki). This can be exploited for remote code execution if the translation value is not properly escaped where it is used. To reproduce, in a multilingual wiki, as a user without script or admin right, edit a translation of AppWithinMinutes.Translations and in the line platform.appwithinminutes.description= add {{async}}{{groovy}}println("Hello from Translation"){{/groovy}}{{/async}} at the end. Then open the app with in minutes home page (AppWithinMinutes.WebHome) in the same locale. If translations are still working and "Hello from Translation" is displayed at the end of the introduction, the installation is vulnerable. Patches This has been patched in XWiki 14.10.20, 15.5.4 and 15.10RC1. Workarounds We're not aware of any workaround except…

    Recommended action: Upgrade to 15.10-rc-1 (pre-release), 15.5.4 or 14.10.20 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →
  2. Medium, CVSS 4.3MavenPublished

    XWiki Platform vulnerable to page render failure due to broken translations

    CVE-2023-29520 · GHSA-9jq5-xwqw-q8j3

    Affected
    • Maven org.xwiki.platform:xwiki-platform-localization-source-wiki >= 4.3-milestone-2, < 13.10.11; >= 14.0-rc-1, < 14.4.8; >= 14.5, < 14.10.1
    Fixed in
    13.10.1114.10.114.4.8· Vendor fix available
    Issue
    Impact It's possible to break many translations coming from wiki pages by creating a corrupted document containing a translation object. Patches The vulnerability has been patched in XWiki 15.0-rc-1, 14.10.1, 14.4.8, and 13.10.11. Workarounds There is no other workaround other than fixing any way to create a document that fail to load. References https://jira.xwiki.org/browse/XWIKI-20460 For more information If you have any questions or comments about this advisory: Open an issue in Jira XWiki.org Email us at Security Mailing List

    Recommended action: Upgrade to 14.10.1, 14.4.8 or 13.10.11 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →