CVSS: 6.1EPSS: 1%CPEs: 4EXPL: 2CVE-2023-29506 – org.xwiki.platform:xwiki-platform-security-authentication-default XSS with authenticated endpoints
https://notcve.org/view.php?id=CVE-2023-29506
XWiki Commons are technical libraries common to several other top level XWiki projects. It was possible to inject some code using the URL of authenticated endpoints. This problem has been patched on XWiki 13.10.11, 14.4.7 and 14.10. • https://github.com/xwiki/xwiki-platform/commit/1943ea26c967ef868fb5f67c487d98d97cba0380 https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-jjm5-5v9v-7hx2 https://jira.xwiki.org/browse/XWIKI-20335 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.9EPSS: 0%CPEs: 3EXPL: 2CVE-2023-29214 – org.xwiki.platform:xwiki-platform-panels-ui Eval Injection vulnerability
https://notcve.org/view.php?id=CVE-2023-29214
XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with edit rights can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of the included pages in the IncludedDocuments panel. The problem has been patched on XWiki 14.4.7, and 14.10. • https://github.com/xwiki/xwiki-platform/commit/50b4d91418b4150933f0317eb4a94ceaf5b69f67 https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-qx9h-c5v6-ghqh https://jira.xwiki.org/browse/XWIKI-20306 • CWE-94: Improper Control of Generation of Code ('Code Injection') CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') •
CVSS: 9.9EPSS: 0%CPEs: 2EXPL: 2CVE-2023-29212 – xwiki.platform:xwiki-platform-panels-ui Eval Injection vulnerability
https://notcve.org/view.php?id=CVE-2023-29212
XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with edit rights can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of the included pages in the included documents edit panel. The problem has been patched on XWiki 14.4.7, and 14.10. • https://github.com/xwiki/xwiki-platform/commit/22f249a0eb9f2a64214628217e812a994419b69f#diff-a51a252f0190274464027342b4e3eafc4ae32de4d9c17ef166e54fc5454c5689R214-R217 https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-c5f4-p5wv-2475 https://jira.xwiki.org/browse/XWIKI-20293 • CWE-94: Improper Control of Generation of Code ('Code Injection') CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') •
CVSS: 9.9EPSS: 0%CPEs: 3EXPL: 2CVE-2023-29211 – org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki Eval Injection vulnerability
https://notcve.org/view.php?id=CVE-2023-29211
XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with view rights `WikiManager.DeleteWiki` can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of the `wikiId` url parameter. The problem has been patched on XWiki 13.10.11, 14.4.7, and 14.10. • https://github.com/xwiki/xwiki-platform/commit/ba4c76265b0b8a5e2218be400d18f08393fe1428#diff-64f39f5f2cc8c6560a44e21a5cfd509ef00e8a2157cd9847c9940a2e08ea43d1R63-R64 https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-w7v9-fc49-4qg4 https://jira.xwiki.org/browse/XWIKI-20297 • CWE-94: Improper Control of Generation of Code ('Code Injection') CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') •
CVSS: 9.9EPSS: 0%CPEs: 3EXPL: 2CVE-2023-29210 – org.xwiki.platform:xwiki-platform-notifications-ui Eval Injection vulnerability
https://notcve.org/view.php?id=CVE-2023-29210
XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with view rights on commonly accessible documents including the notification preferences macros can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of the user parameter of the macro that provide the notification filters. These macros are used in the user profiles and thus installed by default in XWiki. The vulnerability has been patched in XWiki 13.10.11, 14.4.7 and 14.10. • https://github.com/xwiki/xwiki-platform/commit/cebf9167e4fd64a8777781fc56461e9abbe0b32a https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-p9mj-v5mf-m82x https://jira.xwiki.org/browse/XWIKI-20259 • CWE-94: Improper Control of Generation of Code ('Code Injection') CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') •