Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact Any user with edit rights can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of the included pages in the IncludedDocuments panel. Precondition: As an admin, add the Panels.IncludedDocuments panel on one column. A proof of concept exploit is to edit a document and add the following code before saving. expected The right had side panels contain: actual The right had side panels contain: Patches The problem has been patched on XWiki 14.4.7, and 14.10. Workarounds The issue can be fixed manually applying this patch. References - https://github.com/xwiki/xwiki-platform/commit/50b4d91418b4150933f0317eb4a94ceaf5b69f67 - https://jira.xwiki.org/browse/XWIKI-20306 For more information If you have any questions or comments about this advisory: Open an issue in Jira XWiki.org Email us at Security Mailing List
Recommended action: Upgrade to 14.10, 14.4.7 or 13.10.11 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Any user with edit rights can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of the included pages in the included documents edit panel. A proof of concept exploit is to edit a document and add the following code before saving. expected The right had side panels contain: actual The right had side panels contain: Patches The problem has been patched on XWiki 14.4.7, and 14.10. Workarounds The issue can be fixed manually applying this patch. References - https://github.com/xwiki/xwiki-platform/commit/22f249a0eb9f2a64214628217e812a994419b69f#diff-a51a252f0190274464027342b4e3eafc4ae32de4d9c17ef166e54fc5454c5689R214-R217 - https://jira.xwiki.org/browse/XWIKI-20293 For more information If you have any questions or comments about this advisory: Open an issue in Jira XWiki.org Email us at Security Mailing List
Recommended action: Upgrade to 14.10 or 14.4.7 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Any user with view rights can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of UIX parameters A proof of concept exploit is to log in, add an XWiki.UIExtensionClass xobject to the user profile page, with an Extension Parameters content of: Then, navigating to PanelsCode.ApplicationsPanelConfigurationSheet (i.e., <xwiki-host/xwiki/bin/view/PanelsCode/ApplicationsPanelConfigurationSheet where <xwiki-host is the URL of your XWiki installation) should not execute the Groovy script. If it does, you will see Hello from groovy! displayed on the screen. Patches The vulnerability has been patched in XWiki 13.10.11, 14.4.7 and 14.10-rc-1 Workarounds The issue can be fixed by editing the PanelsCode.ApplicationsPanelConfigurationSheet wiki page and making the same modifications as shown in the patch for this issue. References…
Recommended action: Upgrade to 14.10-rc-1 (pre-release), 14.4.7 or 13.10.11 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.