Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact It's possible to display any page you cannot access through the combination of the async and display macro. Steps to reproduce: 1. Enable comments for guests by giving guests comment rights 2. As a guest, create a comment with content 3. Open the comments viewer from the menu (appends ?viewer=comments to the URL) - the Menu.WebHome is displayed while the expectation would be to have an error that the current user is not allowed to see it Patches The vulnerability has been patched in XWiki 15.0-rc-1, 14.10.3, 14.4.8, and 13.10.11. Workarounds There is no known workaround. References https://jira.xwiki.org/browse/XWIKI-20394 https://jira.xwiki.org/browse/XRENDERING-694 For more information If you have any questions or comments about this advisory: Open an issue in Jira XWiki.org Email us at Security Mailing List
Recommended action: Upgrade to 14.10.3, 14.4.8 or 13.10.11 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Comments are supposed to be executed with the right of superadmin but in restricted mode (anything dangerous is disabled) but the async macro is not taking into account the restricted mode. This means that any user with comment right can use the async macro to make it execute any wiki content with the right of superadmin as in: {{async}} {{groovy}}println "it works !"{{/groovy}} {{/async}} Patches This has been patched in XWiki 14.9, 14.4.6, and 13.10.10. Workarounds The only known workaround consists in applying the following patch and rebuilding and redeploying org.xwiki.platform:xwiki-platform-rendering-async-macro. References https://jira.xwiki.org/browse/XWIKI-20234 For more information If you have any questions or comments about this advisory: Open an issue in Jira Email us at Security ML
Recommended action: Upgrade to 14.9, 14.4.6 or 13.10.10 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.