CVSS: 7.1EPSS: 0%CPEs: 3EXPL: 2CVE-2022-31167 – XWiki Platform Security Parent POM vulnerable to overwriting of security rules of a page with a final page having the same reference
https://notcve.org/view.php?id=CVE-2022-31167
XWiki Platform Security Parent POM contains the security APIs for XWiki Platform, a generic wiki platform. Starting with version 5.0 and prior to 12.10.11, 13.10.1, and 13.4.6, a bug in the security cache stores rules associated to document Page1.Page2 and space Page1.Page2 in the same cache entry. That means that it's possible to overwrite the rights of a space or a document by creating the page of the space with the same name and checking the right of the new one first so that they end up in the security cache and are used for the other too. The problem has been patched in XWiki 12.10.11, 13.10.1, and 13.4.6. There are no known workarounds. • https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-gg53-wf5x-r3r6 https://jira.xwiki.org/browse/XWIKI-14075 https://jira.xwiki.org/browse/XWIKI-18983 • CWE-285: Improper Authorization CWE-862: Missing Authorization •
CVSS: 7.4EPSS: 0%CPEs: 3EXPL: 0CVE-2022-29258 – Cross-site Scripting in Filter Stream Converter Application in XWiki Platform
https://notcve.org/view.php?id=CVE-2022-29258
XWiki Platform Filter UI provides a generic user interface to convert from a XWiki Filter input stream to an output stream with settings for each stream. Starting with versions 6.0-milestone-2 and 5.4.4 and prior to versions 12.10.11, 14.0-rc-1, 13.4.7, and 13.10.3, XWiki Platform Filter UI contains a possible cross-site scripting vector in the `Filter.FilterStreamDescriptorForm` wiki page related to pretty much all the form fields printed in the home page of the application. The issue is patched in versions 12.10.11, 14.0-rc-1, 13.4.7, and 13.10.3. The easiest workaround is to edit the wiki page `Filter.FilterStreamDescriptorForm` (with wiki editor) according to the instructions in the GitHub Security Advisory. La interfaz de usuario del filtro de la plataforma XWiki proporciona una interfaz de usuario genérica para convertir de un flujo de entrada del filtro XWiki a un flujo de salida con ajustes para cada flujo. • https://github.com/xwiki/xwiki-platform/commit/21906acb5ee2304552f56f9bbdbf8e7d368f7f3a https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-xjfw-5vv5-vjq2 https://jira.xwiki.org/browse/XWIKI-19293 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) CWE-116: Improper Encoding or Escaping of Output •
CVSS: 7.4EPSS: 0%CPEs: 3EXPL: 0CVE-2022-29251 – Cross-site Scripting in the Flamingo theme manager
https://notcve.org/view.php?id=CVE-2022-29251
XWiki Platform Flamingo Theme UI is a tool that allows customization and preview of any Flamingo-based skin. Starting with versions 6.2.4 and 6.3-rc-1, a possible cross-site scripting vector is present in the `FlamingoThemesCode.WebHomeSheet` wiki page related to the "newThemeName" form field. The issue is patched in versions 12.10.11, 14.0-rc-1, 13.4.7, and 13.10.3. The easiest available workaround is to edit the wiki page `FlamingoThemesCode.WebHomeSheet` (with wiki editor) according to the suggestion provided in the GitHub Security Advisory. XWiki Platform Flamingo Theme UI es una herramienta que permite personalizar y previsualizar cualquier skin basado en Flamingo. • https://github.com/xwiki/xwiki-platform/commit/bd935320bee3c27cf7548351b1d0f935f116d437 https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-vmhh-xh3g-j992 https://jira.xwiki.org/browse/XWIKI-19294 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) CWE-116: Improper Encoding or Escaping of Output •
CVSS: 7.4EPSS: 0%CPEs: 4EXPL: 0CVE-2022-29252 – Cross-site Scripting in XWiki Platform Wiki UI Main Wiki
https://notcve.org/view.php?id=CVE-2022-29252
XWiki Platform Wiki UI Main Wiki is a package for managing subwikis. Starting with version 5.3-milestone-2, XWiki Platform Wiki UI Main Wiki contains a possible cross-site scripting vector in the `WikiManager.JoinWiki ` wiki page related to the "requestJoin" field. The issue is patched in versions 12.10.11, 14.0-rc-1, 13.4.7, and 13.10.3. The easiest available workaround is to edit the wiki page `WikiManager.JoinWiki` (with wiki editor) according to the suggestion provided in the GitHub Security Advisory. XWiki Platform Wiki UI Main Wiki es un paquete para administrar subwikis. • https://github.com/xwiki/xwiki-platform/commit/27f839133d41877e538d35fa88274b50a1c00b9b https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-ph5x-h23x-7q5q https://jira.xwiki.org/browse/XWIKI-19292 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) CWE-116: Improper Encoding or Escaping of Output •
CVSS: 4.0EPSS: 0%CPEs: 2EXPL: 0CVE-2022-29253 – Path Traversal in XWiki Platform
https://notcve.org/view.php?id=CVE-2022-29253
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting with version 8.3-rc-1 and prior to versions 12.10.3 and 14.0, one can ask for any file located in the classloader using the template API and a path with ".." in it. The issue is patched in versions 14.0 and 13.10.3. There is no easy workaround for this issue. La plataforma XWiki es una plataforma wiki genérica que ofrece servicios de tiempo de ejecución para las aplicaciones construidas sobre ella. • https://github.com/xwiki/xwiki-platform/commit/4917c8f355717bb636d763844528b1fe0f95e8e2 https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-9qrp-h7fw-42hg https://jira.xwiki.org/browse/XWIKI-19349 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-24: Path Traversal: '../filedir' •