CVSS: 8.8EPSS: 0%CPEs: 4EXPL: 0CVE-2022-23616 – Remote code execution in xwiki-platform
https://notcve.org/view.php?id=CVE-2022-23616
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible for an unprivileged user to perform a remote code execution by injecting a groovy script in her own profile and by calling the Reset password feature since the feature is performing a save of the user profile with programming rights in the impacted versions of XWiki. The issue has been patched in XWiki 13.1RC1. There are two different possible workarounds, each consisting of modifying the XWiki/ResetPassword page. 1. The Reset password feature can be entirely disabled by deleting the XWiki/ResetPassword page. 2. • https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-mgjw-2wrp-r535 https://jira.xwiki.org/browse/XWIKI-16661 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-23615 – Partial authorization bypass on document save in xwiki-platform
https://notcve.org/view.php?id=CVE-2022-23615
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with SCRIPT right can save a document with the right of the current user which allow accessing API requiring programming right if the current user has programming right. This has been patched in XWiki 13.0. Users are advised to update to resolve this issue. The only known workaround is to limit SCRIPT access. • https://github.com/xwiki/xwiki-platform/commit/7ab0fe7b96809c7a3881454147598d46a1c9bbbe https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-f4cj-3q3h-884r https://jira.xwiki.org/browse/XWIKI-5024 • CWE-863: Incorrect Authorization •
CVSS: 5.4EPSS: 0%CPEs: 2EXPL: 1CVE-2021-43841 – XSS by SVG upload in xwiki-platform
https://notcve.org/view.php?id=CVE-2021-43841
XWiki is a generic wiki platform offering runtime services for applications built on top of it. When using default XWiki configuration, it's possible for an attacker to upload an SVG containing a script executed when executing the download action on the file. This problem has been patched so that the default configuration doesn't allow to display the SVG files in the browser. Users are advised to update or to disallow uploads of SVG files. XWiki es una plataforma wiki genérica que ofrece servicios de tiempo de ejecución para aplicaciones construidas sobre ella. • https://github.com/xwiki/xwiki-platform/commit/5853d492b3a274db0d94d560e2a5ea988a271c62 https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-9jq9-c2cv-pcrj https://jira.xwiki.org/browse/XWIKI-18368 https://www.xwiki.org/xwiki/bin/view/Documentation/AdminGuide/Attachments#HAttachmentdisplayordownload • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 2CVE-2021-32732 – Cross-Site Request Forgery in xwiki-platform
https://notcve.org/view.php?id=CVE-2021-32732
### Impact It's possible to know if a user has or not an account in a wiki related to an email address, and which username(s) is actually tied to that email by forging a request to the Forgot username page. Note that since this page does not have a CSRF check it's quite easy to perform a lot of those requests. ### Patches This issue has been patched in XWiki 12.10.5 and 13.2RC1. Two different patches are provided: - a first one to fix the CSRF problem - a more complex one that now relies on sending an email for the Forgot username process. ### Workarounds It's possible to fix the problem without uprading by editing the ForgotUsername page in version below 13.x, to use the following code: https://github.com/xwiki/xwiki-platform/blob/69548c0320cbd772540cf4668743e69f879812cf/xwiki-platform-core/xwiki-platform-administration/xwiki-platform-administration-ui/src/main/resources/XWiki/ForgotUsername.xml#L39-L123 In version after 13.x it's also possible to edit manually the forgotusername.vm file, but it's really encouraged to upgrade the version here. ### References * https://jira.xwiki.org/browse/XWIKI-18384 * https://jira.xwiki.org/browse/XWIKI-18408 ### For more information If you have any questions or comments about this advisory: * Open an issue in [Jira XWiki](https://jira.xwiki.org) * Email us at [security ML](mailto:security@xwiki.org) ### Impacto Es posible saber si un usuario presenta o no una cuenta en un wiki relacionada con una dirección de correo electrónico, y qué nombre(s) de usuario está(n) realmente vinculado(s) a ese correo electrónico al falsificar una petición a la página de Nombre de usuario olvidado. Ten en cuenta que como esta página no presenta una comprobación de tipo CSRF es bastante fácil llevar a cabo muchas de esas peticiones. ### Parches Este problema ha sido parcheado en XWiki versiones 12.10.5 y 13.2RC1. Se proporcionan dos parches diferentes: - uno para corregir el problema de CSRF - otro más complejo que ahora es basado en el envío de un correo electrónico para el proceso Forgot username. ### Mitigaciones Es posible arreglar el problema sin actualizar al editar la página de ForgotUsername en versiones anteriores a 13.x, para usar el siguiente código: https://github.com/xwiki/xwiki-platform/blob/69548c0320cbd772540cf4668743e69f879812cf/xwiki-platform-core/xwiki-platform-administration/xwiki-platform-administration-ui/src/main/resources/XWiki/ForgotUsername.xml#L39-L123 En la versión posterior a 13.x también es posible editar manualmente el archivo forgotusername.vm, pero es recomendado actualizar la versión aquí. • https://github.com/xwiki/xwiki-platform/commit/69548c0320cbd772540cf4668743e69f879812cf https://github.com/xwiki/xwiki-platform/commit/f0440dfcbba705e03f7565cd88893dde57ca3fa8 https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-vh5c-jqfg-mhrh https://jira.xwiki.org/browse/XWIKI-18384 https://jira.xwiki.org/browse/XWIKI-18408 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2021-32731 – The reset password form reveal users email address
https://notcve.org/view.php?id=CVE-2021-32731
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Between (and including) versions 13.1RC1 and 13.1, the reset password form reveals the email address of users just by giving their username. The problem has been patched on XWiki 13.2RC1. As a workaround, it is possible to manually modify the `resetpasswordinline.vm` to perform the changes made to mitigate the vulnerability. Una plataforma XWiki es una plataforma wiki genérica que ofrece servicios en tiempo de ejecución para las aplicaciones construidas sobre ella. • https://github.com/xwiki/xwiki-platform/commit/0cf716250b3645a5974c80d8336dcdf885749dff#diff-14a3132e3986b1f5606dd13d9d8a8bb8634bec9932123c5e49e9604cfd850fc2 https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-h4m4-pgp4-whgm https://jira.xwiki.org/browse/XWIKI-18400 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •