CVSS: 9.9EPSS: 0%CPEs: 4EXPL: 1CVE-2023-34465 – XWiki Platform's Mail.MailConfig can be edited by any user with edit rights
https://notcve.org/view.php?id=CVE-2023-34465
23 Jun 2023 — XWiki Platform is a generic wiki platform. Starting in version 11.8-rc-1 and prior to versions 14.4.8, 14.10.6, and 15.2, `Mail.MailConfig` can be edited by any logged-in user by default. Consequently, they can change the mail obfuscation configuration and view and edit the mail sending configuration, including the smtp domain name and credentials. The problem has been patched in XWiki 14.4.8, 14.10.6, and 15.1. As a workaround, the rights of the `Mail.MailConfig` page can be manually updated so that only a... • https://github.com/xwiki/xwiki-platform/commit/8910b8857d3442d2e8142f655fdc0512930354d1 • CWE-269: Improper Privilege Management •
CVSS: 9.0EPSS: 1%CPEs: 3EXPL: 2CVE-2023-34464 – XWiki vulnerable to stored cross-site scripting via any wiki document and the displaycontent/rendercontent template
https://notcve.org/view.php?id=CVE-2023-34464
23 Jun 2023 — XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 2.2.1 until versions 14.4.8, 14.10.5, and 15.1RC1 of org.xwiki.platform:xwiki-platform-web and any version prior to 14.4.8, 14.10.5, and 15.1.RC1 of org.xwiki.platform:xwiki-platform-web-templates, any user who can edit a document in a wiki like the user profile can create a stored cross-site scripting attack. The attack occurs by putting plain HTML code into that document and then tr... • https://github.com/xwiki/xwiki-platform/commit/53e8292a31ec70fba5e1d705a4ac443658b9e6df • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 47%CPEs: 2EXPL: 0CVE-2023-32068 – URL Redirection to Untrusted Site in XWiki
https://notcve.org/view.php?id=CVE-2023-32068
15 May 2023 — XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions prior to 14.10.4 it's possible to exploit well known parameters in XWiki URLs to perform redirection to untrusted site. This vulnerability was partially fixed in the past for XWiki 12.10.7 and 13.3RC1 but there is still the possibility to force specific URLs to skip some checks, e.g. using URLs like `http:example.com` in the parameter would allow the redirect. The issue has now been patched a... • https://github.com/xwiki/xwiki-platform/commit/e4f7f68e93cb08c25632c126356d218abf192d1e • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •