Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

org.xwiki.platform:xwiki-platform-uiextension-api

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Critical, CVSS 9.9MavenPublished

    XWiki Platform remote code execution from account through UIExtension parameters

    CVE-2024-31997 · GHSA-c2gg-4gq4-jv5j

    Affected
    • Maven org.xwiki.platform:xwiki-platform-uiextension-api < 14.10.19; >= 15.0-rc-1, < 15.5.4; >= 15.6-rc-1, < 15.9-rc-1
    Fixed in
    15.9-rc-115.5.414.10.19· Vendor fix available
    Issue
    Impact Parameters of UI extensions are always interpreted as Velocity code and executed with programming rights. Any user with edit right on any document like the user's own profile can create UI extensions. This allows remote code execution and thereby impacts the confidentiality, integrity and availability of the whole XWiki installation. To reproduce, edit your user profile with the object editor and add a UIExtension object with the following values: Save the document and open any document. If an application entry with the text "I got programming right: true" is displayed, the attack succeeded, if the code in "label" is displayed literally, the XWiki installation isn't vulnerable. Patches This vulnerability has been patched in XWiki 14.10.19, 15.5.4 and 15.9-RC1. Workarounds We're not aware of any workarounds apart from upgrading. References https://jira.xwiki.org/browse/XWIKI-21335 https://github.com/xwiki/xwiki-platform/commit/171e7c7d0e56deaa7b3678657ae26ef95379b1ea

    Recommended action: Upgrade to 15.9-rc-1 (pre-release), 15.5.4 or 14.10.19 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →