Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
4 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact It's possible to get access and read configuration files by using URLs such as http://localhost:8080/bin/ssx/Main/WebHome?resource=../../WEB-INF/xwiki.cfg&minify=false. This can apparently be reproduced on Tomcat instances. Patches This has been patched in 17.4.0-rc-1, 16.10.7. Workarounds There is no known workaround, other than upgrading XWiki. For more information If you have any questions or comments about this advisory: Open an issue in Jira XWiki.org Email us at Security Mailing List Attribution The vulnerability was reported by Gregor Neumann.
Recommended action: Upgrade to 16.10.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact There was no check in the author of a JavaScript xobject or StyleSheet xobject added in a XWiki document, so until now it was possible for a user having only Edit Right to create such object and to craft a script allowing to perform some operations when executing by a user with appropriate rights. Patches This has been patched in XWiki 14.9-rc-1 by only executing the script if the author of it has Script right. Workarounds The only known workaround consists in applying the following patch and rebuilding and redeploying xwiki-platform-skin-skinx. For more information If you have any questions or comments about this advisory: Open an issue in Jira Email us at Security ML
Recommended action: Upgrade to 14.9-rc-1 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Simple users can create global SSX/JSX without specific rights: in theory only users with Programming Rights should be allowed to create SSX or JSX that are executed everywhere on a wiki. But a bug allow anyone with edit rights to actually create those. Patches This issue has been patched in XWiki 13.10-rc-1, 12.10.11 and 13.4.6. Workarounds There's no easy workaround for this issue, administrators should upgrade their wiki. References https://jira.xwiki.org/browse/XWIKI-19155 For more information If you have any questions or comments about this advisory: Open an issue in JIRA Email us at XWiki Security ML
Recommended action: Upgrade to 13.10, 13.4.6 or 12.10.11 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. AbstractSxExportURLFactoryActionHandler#processSx does not escape anything from SSX document reference when serializing it on filesystem, so it's easy to mess up the HTML export process with reference elements containing filesystem syntax like "../", "./". or "/" in general (the last two not causing any security threat, but can cause conflicts with others serialized files). Patch can be found in 13.6-rc-1. Giving script or subwiki admin right only to trusted people and disabling HTML/PDF export can be done as workaround.
Recommended action: Upgrade to 13.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.