CVSS: 8.1EPSS: 0%CPEs: 2EXPL: 1CVE-2023-37910 – org.xwiki.platform:xwiki-platform-attachment-api vulnerable to Missing Authorization on Attachment Move
https://notcve.org/view.php?id=CVE-2023-37910
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting with the introduction of attachment move support in version 14.0-rc-1 and prior to versions 14.4.8, 14.10.4, and 15.0-rc-1, an attacker with edit access on any document (can be the user profile which is editable by default) can move any attachment of any other document to this attacker-controlled document. This allows the attacker to access and possibly publish any attachment of which the name is known, regardless if the attacker has view or edit rights on the source document of this attachment. Further, the attachment is deleted from the source document. This vulnerability has been patched in XWiki 14.4.8, 14.10.4, and 15.0 RC1. • https://github.com/xwiki/xwiki-platform/commit/d7720219d60d7201c696c3196c9d4a86d0881325 https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-rwwx-6572-mp29 https://jira.xwiki.org/browse/XWIKI-20334 • CWE-862: Missing Authorization •
CVSS: 9.9EPSS: 0%CPEs: 1EXPL: 2CVE-2023-37909 – Privilege escalation (PR)/remote code execution from account through Menu.UIExtensionSheet
https://notcve.org/view.php?id=CVE-2023-37909
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 5.1-rc-1 and prior to versions 14.10.8 and 15.3-rc-1, any user who can edit their own user profile can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. This has been patched in XWiki 14.10.8 and 15.3-rc-1 by adding proper escaping. As a workaround, the patch can be manually applied to the document `Menu.UIExtensionSheet`; only three lines need to be changed. XWiki Platform es una plataforma wiki genérica que ofrece servicios de ejecución para aplicaciones creadas sobre ella. • https://github.com/xwiki/xwiki-platform/commit/9e8f080094333dec63a8583229a3799208d773be https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-v2rr-xw95-wcjx https://jira.xwiki.org/browse/XWIKI-20746 • CWE-94: Improper Control of Generation of Code ('Code Injection') CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') •
CVSS: 9.6EPSS: 0%CPEs: 1EXPL: 3CVE-2023-37908 – org.xwiki.rendering:xwiki-rendering-xml Improper Neutralization of Invalid Characters in Identifiers in Web Pages vulnerability
https://notcve.org/view.php?id=CVE-2023-37908
XWiki Rendering is a generic Rendering system that converts textual input in a given syntax into another syntax. The cleaning of attributes during XHTML rendering, introduced in version 14.6-rc-1, allowed the injection of arbitrary HTML code and thus cross-site scripting via invalid attribute names. This can be exploited, e.g., via the link syntax in any content that supports XWiki syntax like comments in XWiki. When a user moves the mouse over a malicious link, the malicious JavaScript code is executed in the context of the user session. When this user is a privileged user who has programming rights, this allows server-side code execution with programming rights, impacting the confidentiality, integrity and availability of the XWiki instance. • https://github.com/xwiki/xwiki-rendering/commit/f4d5acac451dccaf276e69f0b49b72221eef5d2f https://github.com/xwiki/xwiki-rendering/security/advisories/GHSA-663w-2xp3-5739 https://github.com/xwiki/xwiki-rendering/security/advisories/GHSA-6gf5-c898-7rxp https://jira.xwiki.org/browse/XRENDERING-697 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-83: Improper Neutralization of Script in Attributes in a Web Page •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2023-45144 – Remote code execution from login screen through unescaped URL parameter in OAuth Identity XWiki App
https://notcve.org/view.php?id=CVE-2023-45144
com.xwiki.identity-oauth:identity-oauth-ui is a package to aid in building identity and service providers based on OAuth authorizations. When a user logs in via the OAuth method, the identityOAuth parameters sent in the GET request is vulnerable to cross site scripting (XSS) and XWiki syntax injection. This allows remote code execution via the groovy macro and thus affects the confidentiality, integrity and availability of the whole XWiki installation. The issue has been fixed in Identity OAuth version 1.6. There are no known workarounds for this vulnerability and users are advised to upgrade. com.xwiki.identity-oauth:identity-oauth-ui es un paquete para ayudar a crear identidades y proveedores de servicios basados en autorizaciones OAuth. • https://github.com/xwikisas/identity-oauth/blob/master/ui/src/main/resources/IdentityOAuth/LoginUIExtension.vm#L58 https://github.com/xwikisas/identity-oauth/commit/d805d3154b17c6bf455ddf5deb0a3461a3833bc6 https://github.com/xwikisas/identity-oauth/commit/d805d3154b17c6bf455ddf5deb0a3461a3833bc6#diff-2ab2e0716443d790d7d798320e4a45151661f4eca5440331f4a227b29c87c188 https://github.com/xwikisas/identity-oauth/security/advisories/GHSA-h2rm-29ch-wfmh https://jira.xwiki.org/browse/XWIKI-20719 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2023-45138 – Change Request Application vulnerable to XSS and remote code execution through change request title
https://notcve.org/view.php?id=CVE-2023-45138
Change Request is an pplication allowing users to request changes on a wiki without publishing the changes directly. Starting in version 0.11 and prior to version 1.9.2, it's possible for a user without any specific right to perform script injection and remote code execution just by inserting an appropriate title when creating a new Change Request. This vulnerability is particularly critical as Change Request aims at being created by user without any particular rights. The vulnerability has been fixed in Change Request 1.9.2. It's possible to workaround the issue without upgrading by editing the document `ChangeRequest.Code.ChangeRequestSheet` and by performing the same change as in the fix commit. • https://github.com/xwiki-contrib/application-changerequest/commit/7565e720117f73102f5a276239eabfe85e15cff4 https://github.com/xwiki-contrib/application-changerequest/security/advisories/GHSA-f776-w9v2-7vfj https://jira.xwiki.org/browse/CRAPP-298 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •