Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

org.xwiki.platform:xwiki-platform-tool-configuration-resources

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 4.1MavenPublished

    Cross-site Scripting by SVG upload in xwiki-platform

    CVE-2021-43841 · GHSA-9jq9-c2cv-pcrj

    Affected
    • Maven org.xwiki.platform:xwiki-platform-tool-configuration-resources >= 13.0, <= 13.2; < 12.10.6
    Fixed in
    13.3RC112.10.6· Vendor fix available
    Issue
    Impact When using default XWiki configuration, it's possible for an attacker to upload an SVG containing a script executed when executing the download action on the file. Patches This problem has been patched so that the default configuration doesn't allow to display the SVG files in the browser. Workarounds This issue can be fixed without the patch by setting properly the configuration to download or display files, see: https://www.xwiki.org/xwiki/bin/view/Documentation/AdminGuide/Attachments#HAttachmentdisplayordownload References https://jira.xwiki.org/browse/XWIKI-18368 For more information If you have any questions or comments about this advisory: Open an issue in Jira Email us at security ML

    Recommended action: Upgrade to 13.3RC1 (pre-release) or 12.10.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →