Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

org.xwiki.platform:xwiki-platform-xar-model

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.7MavenPublished

    XWiki Platform vulnerable to data leak via Improper Restriction of XML External Entity Reference

    CVE-2023-27480 · GHSA-gx4f-976g-7g6v

    Affected
    • Maven org.xwiki.platform:xwiki-platform-xar-model >= 1.1-milestone-3, < 13.10.11; >= 14.0, < 14.4.7; >= 14.5, < 14.10-rc-1
    Fixed in
    14.4.713.10.1114.10-rc-1· Vendor fix available
    Issue
    Impact Any user with edit rights on a document can trigger a XAR import on a forged XAR file, leading to the ability to display the content of any file on the XWiki server host. Example to reproduce: Create a forget XAR file and inside it, have the following package.xml content: Upload it onto a wiki page (e.g. XXE) as an attachment (e.g. test.xar). Call the page using http://localhost:8080/xwiki/bin/view/Main/XXE?sheet=XWiki.AdminImportSheet&file=test.xar You'll then notice that the displayed UI contains the content of the /etc/passwd file. Patches The vulnerability has been patched in XWiki 13.10.11, 14.4.7 and 14.10-rc-1. Workarounds You'd need to get XWiki Platform sources and apply the changes from https://github.com/xwiki/xwiki-platform/commit/e3527b98fdd8dc8179c24dc55e662b2c55199434 to the XarPackage java class and then copy the modified version to your WEB-INF/classes directory (or rebuild the xwiki-platform-xar-model maven module and replace the one found in WEB-INF/lib/).…

    Recommended action: Upgrade to 14.10-rc-1 (pre-release), 14.4.7 or 13.10.11 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →