CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2022-23619 – Information exposure in xwiki-platform
https://notcve.org/view.php?id=CVE-2022-23619
09 Feb 2022 — XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible to guess if a user has an account on the wiki by using the "Forgot your password" form, even if the wiki is closed to guest users. This problem has been patched on XWiki 12.10.9, 13.4.1 and 13.6RC1. Users are advised yo update. There are no known workarounds for this issue. • https://github.com/xwiki/xwiki-platform/commit/d8a3cce48e0ac1a0f4a3cea7a19747382d9c9494 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-640: Weak Password Recovery Mechanism for Forgotten Password •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2022-23618 – Open Redirect in xwiki-platform
https://notcve.org/view.php?id=CVE-2022-23618
09 Feb 2022 — XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions there is no protection against URL redirection to untrusted sites, in particular some well known parameters (xredirect) can be used to perform url redirections. This problem has been patched in XWiki 12.10.7 and XWiki 13.3RC1. Users are advised to update. There are no known workarounds for this issue. • https://github.com/xwiki/xwiki-platform/commit/5251c02080466bf9fb55288f04a37671108f8096 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2022-23617 – Missing authorization in xwiki-platform
https://notcve.org/view.php?id=CVE-2022-23617
09 Feb 2022 — XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with edit right can copy the content of a page it does not have access to by using it as template of a new page. This issue has been patched in XWiki 13.2CR1 and 12.10.6. Users are advised to update. There are no known workarounds for this issue. • https://github.com/xwiki/xwiki-platform/commit/30c52b01559b8ef5ed1035dac7c34aaf805764d5 • CWE-862: Missing Authorization •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-23615 – Partial authorization bypass on document save in xwiki-platform
https://notcve.org/view.php?id=CVE-2022-23615
09 Feb 2022 — XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with SCRIPT right can save a document with the right of the current user which allow accessing API requiring programming right if the current user has programming right. This has been patched in XWiki 13.0. Users are advised to update to resolve this issue. The only known workaround is to limit SCRIPT access. • https://github.com/xwiki/xwiki-platform/commit/7ab0fe7b96809c7a3881454147598d46a1c9bbbe • CWE-863: Incorrect Authorization •
CVSS: 5.4EPSS: 0%CPEs: 2EXPL: 1CVE-2021-43841 – XSS by SVG upload in xwiki-platform
https://notcve.org/view.php?id=CVE-2021-43841
04 Feb 2022 — XWiki is a generic wiki platform offering runtime services for applications built on top of it. When using default XWiki configuration, it's possible for an attacker to upload an SVG containing a script executed when executing the download action on the file. This problem has been patched so that the default configuration doesn't allow to display the SVG files in the browser. Users are advised to update or to disallow uploads of SVG files. XWiki es una plataforma wiki genérica que ofrece servicios de tiempo... • https://github.com/xwiki/xwiki-platform/commit/5853d492b3a274db0d94d560e2a5ea988a271c62 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 2CVE-2021-32732 – Cross-Site Request Forgery in xwiki-platform
https://notcve.org/view.php?id=CVE-2021-32732
04 Feb 2022 — ### Impact It's possible to know if a user has or not an account in a wiki related to an email address, and which username(s) is actually tied to that email by forging a request to the Forgot username page. Note that since this page does not have a CSRF check it's quite easy to perform a lot of those requests. ### Patches This issue has been patched in XWiki 12.10.5 and 13.2RC1. Two different patches are provided: - a first one to fix the CSRF problem - a more complex one that now relies on sending an email... • https://github.com/xwiki/xwiki-platform/commit/69548c0320cbd772540cf4668743e69f879812cf • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 5.7EPSS: 0%CPEs: 4EXPL: 1CVE-2021-32730 – No CSRF protection on the password change form
https://notcve.org/view.php?id=CVE-2021-32730
01 Jul 2021 — XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A cross-site request forgery vulnerability exists in versions prior to 12.10.5, and in versions 13.0 through 13.1. It's possible for forge an URL that, when accessed by an admin, will reset the password of any user in XWiki. The problem has been patched in XWiki 12.10.5 and 13.2RC1. As a workaround, it is possible to apply the patch manually by modifying the `register_macros.vm` template. • https://github.com/xwiki/xwiki-platform/commit/0a36dbcc5421d450366580217a47cc44d32f7257 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 9.6EPSS: 0%CPEs: 2EXPL: 1CVE-2021-29459 – XSS Cross Site Scripting
https://notcve.org/view.php?id=CVE-2021-29459
20 Apr 2021 — XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It is possible to persistently inject scripts in XWiki versions prior to 12.6.3 and 12.8. Unregistred users can fill simple text fields. Registered users can fill in their personal information and (if they have edit rights) fill the values of static lists using App Within Minutes. There is no easy workaround except upgrading XWiki. • https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-5c66-v29h-xjh8 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-13654
https://notcve.org/view.php?id=CVE-2020-13654
31 Dec 2020 — XWiki Platform before 12.8 mishandles escaping in the property displayer. XWiki Platform versiones anteriores a 12.8, maneja inapropiadamente el escape en el visualizador de propiedades. • https://cve.nstsec.com/cve-2020-13654 • CWE-116: Improper Encoding or Escaping of Output •
CVSS: 9.0EPSS: 2%CPEs: 2EXPL: 1CVE-2020-15252 – RCE in XWiki
https://notcve.org/view.php?id=CVE-2020-15252
16 Oct 2020 — In XWiki before version 12.5 and 11.10.6, any user with SCRIPT right (EDIT right before XWiki 7.4) can gain access to the application server Servlet context which contains tools allowing to instantiate arbitrary Java objects and invoke methods that may lead to arbitrary code execution. This is patched in XWiki 12.5 and XWiki 11.10.6. En XWiki versiones anteriores a 2.5 y 11.10.6, cualquier usuario con derecho de SCRIPT (EDITA justo antes de XWiki versión 7.4) puede obtener acceso al contexto de Servlet del ... • https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-5hv6-mh8q-q9v8 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CWE-94: Improper Control of Generation of Code ('Code Injection') •