CVSS: 9.0EPSS: 0%CPEs: 3EXPL: 2CVE-2023-34464 – XWiki vulnerable to stored cross-site scripting via any wiki document and the displaycontent/rendercontent template
https://notcve.org/view.php?id=CVE-2023-34464
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 2.2.1 until versions 14.4.8, 14.10.5, and 15.1RC1 of org.xwiki.platform:xwiki-platform-web and any version prior to 14.4.8, 14.10.5, and 15.1.RC1 of org.xwiki.platform:xwiki-platform-web-templates, any user who can edit a document in a wiki like the user profile can create a stored cross-site scripting attack. The attack occurs by putting plain HTML code into that document and then tricking another user to visit that document with the `displaycontent` or `rendercontent` template and plain output syntax. If a user with programming rights is tricked into visiting such a URL, arbitrary actions be performed with this user's rights, impacting the confidentiality, integrity, and availability of the whole XWiki installation. This has been patched in XWiki 14.4.8, 14.10.5 and 15.1RC1 by setting the content type of the response to plain text when the output syntax is not an HTML syntax. • https://github.com/xwiki/xwiki-platform/commit/53e8292a31ec70fba5e1d705a4ac443658b9e6df https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-fp7h-f9f5-x4q7 https://jira.xwiki.org/browse/XWIKI-20290 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 28%CPEs: 2EXPL: 0CVE-2023-32068 – URL Redirection to Untrusted Site in XWiki
https://notcve.org/view.php?id=CVE-2023-32068
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions prior to 14.10.4 it's possible to exploit well known parameters in XWiki URLs to perform redirection to untrusted site. This vulnerability was partially fixed in the past for XWiki 12.10.7 and 13.3RC1 but there is still the possibility to force specific URLs to skip some checks, e.g. using URLs like `http:example.com` in the parameter would allow the redirect. The issue has now been patched against all patterns that are known for performing redirects. This issue has been patched in XWiki 14.10.4 and 15.0. • https://github.com/xwiki/xwiki-platform/commit/e4f7f68e93cb08c25632c126356d218abf192d1e https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-6gvj-8vc5-8v3j https://jira.xwiki.org/browse/XWIKI-20096 https://jira.xwiki.org/browse/XWIKI-20549 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 9.0EPSS: 0%CPEs: 2EXPL: 0CVE-2023-32070 – Improper Neutralization of Script in Attributes in XWiki (X)HTML renderers
https://notcve.org/view.php?id=CVE-2023-32070
XWiki Platform is a generic wiki platform. Prior to version 14.6-rc-1, HTML rendering didn't check for dangerous attributes/attribute values. This allowed cross-site scripting (XSS) attacks via attributes and link URLs, e.g., supported in XWiki syntax. This has been patched in XWiki 14.6-rc-1. There are no known workarounds apart from upgrading to a fixed version. • https://github.com/xwiki/xwiki-rendering/commit/c40e2f5f9482ec6c3e71dbf1fff5ba8a5e44cdc1 https://github.com/xwiki/xwiki-rendering/security/advisories/GHSA-6gf5-c898-7rxp https://jira.xwiki.org/browse/XRENDERING-663 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-83: Improper Neutralization of Script in Attributes in a Web Page •
CVSS: 9.0EPSS: 0%CPEs: 3EXPL: 0CVE-2023-32071 – XWiki Platform vulnerable to RXSS via editor parameter - importinline template
https://notcve.org/view.php?id=CVE-2023-32071
XWiki Platform is a generic wiki platform. Starting in versions 2.2-milestone-1 and prior to versions 14.4.8, 14.10.4, and 15.0-rc-1, it's possible to execute javascript with the right of any user by leading him to a special URL on the wiki targeting a page which contains an attachment. This has been patched in XWiki 15.0-rc-1, 14.10.4, and 14.4.8. The easiest possible workaround is to edit file `<xwiki app>/templates/importinline.vm` and apply the modification described in commit 28905f7f518cc6f21ea61fe37e9e1ed97ef36f01. • https://app.intigriti.com/company/submissions/e95a7ad5-7029-4627-abf0-3e3e3ea0b4ce/XWIKI-E93DFEYK https://github.com/xwiki/xwiki-platform/commit/28905f7f518cc6f21ea61fe37e9e1ed97ef36f01 https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-j9h5-vcgv-2jfm https://jira.xwiki.org/browse/XWIKI-20340 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-116: Improper Encoding or Escaping of Output •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 4CVE-2023-29517 – Exposure of Sensitive Information to an Unauthorized Actor in org.xwiki.platform:xwiki-platform-office-viewer
https://notcve.org/view.php?id=CVE-2023-29517
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The office document viewer macro was allowing anyone to see any file content from the hosting server, provided that the office server was connected and depending on the permissions of the user running the servlet engine (e.g. tomcat) running XWiki. The same vulnerability also allowed to perform internal requests to resources from the hosting server. The problem has been patched in XWiki 13.10.11, 14.10.1, 14.4.8, 15.0-rc-1. Users are advised to upgrade. • https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-m3c3-9qj7-7xmx https://jira.xwiki.org/browse/XWIKI-20324 https://jira.xwiki.org/browse/XWIKI-20447 https://jira.xwiki.org/browse/XWIKI-20449 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •