SB2022112156 - Multiple vulnerabilities in XWiki platform

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2022112156

SB2022112156 - Multiple vulnerabilities in XWiki platform

Published: November 21, 2022 Updated: May 5, 2026

Security Bulletin ID SB2022112156
CSH Severity
High
Patch available
YES
Number of vulnerabilities 85
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 7% Medium 74% Low 19%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 85 vulnerabilities.


1) Incorrect authorization (CVE-ID: CVE-2023-41046)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to disclose sensitive information and modify data.

The vulnerability exists due to improper access control in TextArea properties with the "VelocityCode" or "VelocityWiki" content type when adding the property to an object. A remote user can create an XClass with such a property to disclose sensitive information and modify data.

For the "VelocityCode" case, the document syntax must be set to xwiki/1.0. The executed code runs with the context author and cannot access privileged APIs.


2) Improper access control (CVE-ID: CVE-2023-40573)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to improper access control in Groovy scheduled jobs when checking the content author for programming right and triggering jobs through the scheduler. A remote user can create or modify a Groovy job in a document whose content was last changed by a user with programming right and trigger it via a crafted request to execute arbitrary code.

User interaction is required, and exploitation requires edit right on a document whose content was last changed by a user with programming right.


3) Cross-site request forgery (CVE-ID: CVE-2023-40572)

CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to cross-site request forgery in the create action when handling crafted create requests embedded in XWiki syntax content. A remote user can place a specially crafted image reference in content that supports XWiki syntax to execute arbitrary code.

User interaction is required, and exploitation succeeds when a user with script or programming right views the crafted content.


4) Exposure of Resource to Wrong Sphere (CVE-ID: CVE-2023-37911)

CWE-ID: CWE-668 - Exposure of resource to wrong sphere

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper access control in deleted document revisions when accessing deleted revisions through the diff feature or the REST API. A remote user can request versions such as deleted:1 to disclose sensitive information.

The issue occurs when a document has been deleted and re-created, and can also affect any deleted document if the user can re-create it in the original location.


5) Transmission of Private Resources into a New Sphere ('Resource Leak') (CVE-ID: CVE-2023-38509)

CWE-ID: CWE-402 - Transmission of Private Resources into a New Sphere ('Resource Leak')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to transmission of private resources into a new sphere in the live table email sorting functionality when handling sorting of obfuscated email addresses. A remote user can sort by obfuscated email addresses to disclose sensitive information.


6) Eval Injection (CVE-ID: CVE-2023-37909)

CWE-ID: CWE-95 - Eval Injection

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to improper neutralization of directives in dynamically evaluated code in Menu.UIExtensionSheet when processing user-controlled UIExtensionClass data from a user profile. A remote user can add a crafted UIExtensionClass object to their own profile and access the sheet to execute arbitrary code.

The issue can be exploited by a user who is able to edit their own user profile, and it also allows unrestricted read and write access to all wiki contents.


7) Cross-site request forgery (CVE-ID: CVE-2023-46242)

CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to execute content with the rights of the targeted user.

The vulnerability exists due to cross-site request forgery (CSRF) in the edit action when handling crafted edit URLs. A remote attacker can trick a user into following a crafted URL to execute content with the rights of the targeted user.

User interaction is required, and exploitation can lead to code execution if the targeted user has programming rights.


8) Cross-site request forgery (CVE-ID: CVE-2023-37277)

CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to cross-site request forgery in the REST API when handling POST requests with form-compatible content types. A remote attacker can cause the victim to submit a crafted request to execute arbitrary code.

User interaction with a user who has programming rights is required for code execution through script macros.


9) Incorrect Privilege Assignment (CVE-ID: CVE-2023-36468)

CWE-ID: CWE-266 - Incorrect Privilege Assignment

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to incorrect privilege assignment in old document revisions when accessing a vulnerable document revision through the rev URL parameter. A remote user can request an old vulnerable revision of a document to execute arbitrary code.

This affects upgraded installations and can also affect manually added script macros whose vulnerable versions remain in document history. Fresh installations are not affected, and content that is only loaded from the current version of a document is not affected.


10) Relative Path Traversal (CVE-ID: CVE-2023-37913)

CWE-ID: CWE-23 - Relative Path Traversal

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to relative path traversal in the office converter when processing an attachment with a specially crafted file name. A remote user can upload or rename an attachment to write its contents to an attacker-controlled location on the server to execute arbitrary code.

Exploitation requires the office conversion process to be running, and successful file writing depends on the Java process having write access to the target location.


11) Incorrect authorization (CVE-ID: CVE-2023-50732)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to execute a Velocity script without script right.

The vulnerability exists due to incorrect authorization in the document tree macro when rendering the document tree. A remote attacker can create a document with a crafted title containing Velocity code to execute a Velocity script without script right.


12) Incorrect authorization (CVE-ID: CVE-2023-46244)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to escalate privileges.

The vulnerability exists due to incorrect authorization in the title displayer API when executing velocity content in a script. A remote privileged user can create a document containing specially crafted velocity code to escalate privileges.

The issue allows velocity content to be executed with the rights of another document's content author.


13) Incorrect authorization (CVE-ID: CVE-2023-46243)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to execute arbitrary code with the rights of an existing document's content author.

The vulnerability exists due to incorrect authorization in the edit action when handling edit requests with user-supplied content. A remote user can send a specially crafted edit URL to execute arbitrary code with the rights of an existing document's content author.

Exploitation requires edit rights on a document whose content author has programming right or script right.


14) Eval Injection (CVE-ID: CVE-2023-36469)

CWE-ID: CWE-95 - Eval Injection

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to execute arbitrary script macros.

The vulnerability exists due to improper neutralization of directives in dynamically evaluated code in NotificationRSSService when generating the RSS feed from user-controlled profile and notification data. A remote user can inject crafted macro code into profile fields to execute arbitrary script macros.

This can lead to unrestricted read and write access to all wiki contents.


15) Eval Injection (CVE-ID: CVE-2023-40177)

CWE-ID: CWE-95 - Eval Injection

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to execute arbitrary scripts with programming rights.

The vulnerability exists due to improper neutralization of directives in dynamically evaluated code in the AppWithinMinutes content field displayer when rendering the content field of a user profile page. A remote user can place crafted script content in their profile content field to execute arbitrary scripts with programming rights.

The issue affects cases where a wiki page, including a user profile page, is used as an AWM Content field and the content is executed with the rights of the AppWithinMinutes.Content author instead of the content author.


16) Eval Injection (CVE-ID: CVE-2023-37914)

CWE-ID: CWE-95 - Eval Injection

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to improper neutralization of directives in dynamically evaluated code in the invitation application subject and message preview handling when processing user-supplied invitation subject or message content. A remote user can submit specially crafted macro content to execute arbitrary code.

The issue affects users who can view Invitation.WebHome, and exploitation can provide unrestricted read and write access to wiki contents.


17) Eval Injection (CVE-ID: CVE-2023-35152)

CWE-ID: CWE-95 - Eval Injection

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to escalate privileges.

The vulnerability exists due to improper neutralization of directives in dynamically evaluated code in like LiveTableResults when rendering a user's first name field. A remote user can place dangerous content in their first name field to escalate privileges.

The injected content can be executed with programming rights.


18) Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) (CVE-ID: CVE-2023-35157)

CWE-ID: CWE-80 - Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to execute arbitrary script in the user's browser.

The vulnerability exists due to improper neutralization of script-related HTML tags in delattachment action when processing a forged delete attachment request with a specific attachment name. A remote privileged user can send a specially crafted request to execute arbitrary script in the user's browser.

Exploitation requires user interaction and is possible only if the attacker knows the user's CSRF token or if the user ignores the warning about the missing CSRF token.


19) Cross-site scripting (CVE-ID: CVE-2023-34464)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear


The vulnerability allows a remote user to execute arbitrary actions with the victim's rights.

The vulnerability exists due to cross-site scripting in the displaycontent/rendercontent template when rendering plain HTML from an editable wiki document with plain output syntax. A remote user can place malicious HTML in a wiki document and trick the victim into visiting a crafted URL to execute arbitrary actions with the victim's rights.

User interaction is required, and exploitation depends on the victim visiting the document through the displaycontent or rendercontent template with plain output syntax.


20) Exposure of Private Information ('Privacy Violation') (CVE-ID: CVE-2023-35151)

CWE-ID: CWE-359 - Exposure of Private Information ('Privacy Violation')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to exposure of private personal information in the REST endpoint for XWiki user objects when handling requests for user object results. A remote attacker can send a request to the REST API to disclose sensitive information.

Email addresses are returned in clear text even when mail obfuscation is enabled.


21) Eval Injection (CVE-ID: CVE-2023-36470)

CWE-ID: CWE-95 - Eval Injection

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to improper neutralization of directives in dynamically evaluated code in icon themes when rendering icon sets from created or edited documents. A remote user can inject XWiki syntax and Velocity code to execute arbitrary code.

The injected code can be executed with programming rights, impacting the confidentiality, integrity, and availability of the whole XWiki instance.


22) Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) (CVE-ID: CVE-2023-36477)

CWE-ID: CWE-80 - Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to execute arbitrary script code in users' browsers.

The vulnerability exists due to improper neutralization of script-related HTML tags in CKEditor javascript configuration pages when editing pages in the CKEditor space. A remote user can modify the javascript configuration to execute arbitrary script code in users' browsers.

User interaction is required to load the affected content.


23) Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) (CVE-ID: CVE-2023-40176)

CWE-ID: CWE-80 - Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to execute arbitrary script code in a victim's browser.

The vulnerability exists due to improper neutralization of script-related HTML tags in displayer_timezone.vm when displaying the time zone user preference in a user profile. A remote user can set a crafted time zone value through the profile save request to execute arbitrary script code in a victim's browser.

User interaction is required because a victim must visit the malicious user profile.


24) Improper Neutralization of Alternate XSS Syntax (CVE-ID: CVE-2023-35160)

CWE-ID: CWE-87 - Improper Neutralization of Alternate XSS Syntax

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to inject arbitrary JavaScript in the page.

The vulnerability exists due to improper neutralization of alternate XSS syntax in the resubmit template when handling the xback and xcontinue URL parameters. A remote attacker can forge a URL with a crafted payload to inject arbitrary JavaScript in the page.

User interaction is required to open the crafted URL.


25) Improper Neutralization of Alternate XSS Syntax (CVE-ID: CVE-2023-35156)

CWE-ID: CWE-87 - Improper Neutralization of Alternate XSS Syntax

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to inject javascript in the page.

The vulnerability exists due to improper neutralization of alternate XSS syntax in the delete template when processing the xredirect parameter. A remote attacker can send a specially crafted URL to inject javascript in the page.

User interaction is required to open the crafted URL.


26) Incorrect authorization (CVE-ID: CVE-2023-35166)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to execute arbitrary wiki content with the rights of the TipsPanel author.

The vulnerability exists due to incorrect authorization in the TipsPanel UI extension handling when processing a crafted tip UI extension. A remote user can create a tip UI extension for the org.xwiki.platform.help.tipsPanel extension point to execute arbitrary wiki content with the rights of the TipsPanel author.


27) Open redirect (CVE-ID: CVE-2023-32068)

CWE-ID: CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to redirect users to an untrusted site.

The vulnerability exists due to url redirection to an untrusted site in URL redirect handling when processing well known URL parameters. A remote attacker can supply a crafted redirect parameter value such as http:example.com to redirect users to an untrusted site.

User interaction is required for exploitation.


28) Insufficiently protected credentials (CVE-ID: CVE-2023-34465)

CWE-ID: CWE-522 - Insufficiently Protected Credentials

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to disclose sensitive information and modify mail configuration.

The vulnerability exists due to improper access control in Mail.MailConfig when handling edit requests. A remote user can edit the page to view and modify the mail sending configuration, including the SMTP domain name and credentials, to disclose sensitive information and modify mail configuration.

By default, any logged-in user with edit rights can exploit this issue.


29) Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) (CVE-ID: CVE-2023-35153)

CWE-ID: CWE-80 - Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to execute arbitrary script code in a victim's browser.

The vulnerability exists due to improper neutralization of script-related HTML tags in AppWithinMinutes.ClassEditSheet when rendering name parameters from a page title. A remote user can set a malicious payload in the title of a page with the AppWithinMinutes.FormFieldCategoryClass class and cause execution of arbitrary script code in a victim's browser.

User interaction is required when a victim visits /xwiki/bin/view/AppWithinMinutes/ClassEditSheet.


30) Improper Encoding or Escaping of Output (CVE-ID: CVE-2023-32071)

CWE-ID: CWE-116 - Improper Encoding or Escaping of Output

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to execute arbitrary JavaScript in the context of another user's session.

The vulnerability exists due to improper encoding or escaping of output in the importinline template when handling the editor parameter in a crafted URL targeting a page that contains an attachment. A remote user can send a specially crafted URL to execute arbitrary JavaScript in the context of another user's session.

User interaction is required to visit the crafted URL, and the target page must contain an attachment.


31) Incorrect authorization (CVE-ID: CVE-2023-32069)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to incorrect authorization in the XWiki.ClassSheet document handling when rendering a user profile containing a DocumentSheetBinding object bound to the Default Class Sheet. A remote user can add a DocumentSheetBinding object to their profile and inject crafted Groovy macro content to execute arbitrary code.

The code is executed with the rights of the author of the XWiki.ClassSheet document.


32) Improper Neutralization of Alternate XSS Syntax (CVE-ID: CVE-2023-35158)

CWE-ID: CWE-87 - Improper Neutralization of Alternate XSS Syntax

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to inject arbitrary JavaScript in the page.

The vulnerability exists due to improper neutralization of alternate XSS syntax in the restore template when handling the xredirect parameter in a crafted URL. A remote attacker can send a specially crafted URL to inject arbitrary JavaScript in the page.

User interaction is required to open the crafted URL.


33) Cross-site scripting (CVE-ID: CVE-2023-35155)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to inject arbitrary JavaScript in the page.

The vulnerability exists due to cross-site scripting in the share page target parameter when handling a forged URL. A remote attacker can send a specially crafted link to inject arbitrary JavaScript in the page.

User interaction is required to open the crafted link.


34) Missing Authorization (CVE-ID: CVE-2023-37910)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to disclose sensitive information and modify attachments.

The vulnerability exists due to missing authorization in attachment move support in org.xwiki.platform:xwiki-platform-attachment-api when moving attachments between documents. A remote user can move an attachment from another document to an attacker-controlled document to disclose sensitive information and modify attachments.

The source attachment name must be known, and the moved attachment is deleted from the source document.


35) Improper access control (CVE-ID: CVE-2023-29527)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to execute arbitrary code and escalate privileges.

The vulnerability exists due to improper access control in the AWM view sheet when viewing a document containing an AppWithinMinutes.LiveTableClass object. A remote user can add such an object to a document with script content and view the document to execute arbitrary code and escalate privileges.


36) Transmission of Private Resources into a New Sphere ('Resource Leak') (CVE-ID: CVE-2023-34467)

CWE-ID: CWE-402 - Transmission of Private Resources into a New Sphere ('Resource Leak')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to transmission of private resources into a new sphere in the live table REST response when handling user listing requests. A remote attacker can send a request to retrieve unobfuscated email addresses to disclose sensitive information.

The issue also allows filtering and sorting on unobfuscated email values, which can be used to infer email content even when displayed addresses are obfuscated.


37) Improper Encoding or Escaping of Output (CVE-ID: CVE-2023-29525)

CWE-ID: CWE-116 - Improper Encoding or Escaping of Output

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to escalate privileges.

The vulnerability exists due to improper encoding or escaping of output in XWiki.Notifications.Code.LegacyNotificationAdministration when handling the since parameter. A remote user can send a specially crafted request to escalate privileges.

The issue allows privilege escalation from view right to programming rights through XWiki syntax injection.


38) Improper Encoding or Escaping of Output (CVE-ID: CVE-2023-29524)

CWE-ID: CWE-116 - Improper Encoding or Escaping of Output

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to execute arbitrary code with elevated privileges.

The vulnerability exists due to improper encoding or escaping of output in XWiki.SchedulerJobSheet when rendering a user profile containing a crafted XWiki.SchedulerJobClass object. A remote user can add a malicious job script to their profile and access the scheduler job sheet to execute arbitrary code with elevated privileges.

The issue can be triggered by a user without script or programming rights.


39) Eval Injection (CVE-ID: CVE-2023-35150)

CWE-ID: CWE-95 - Eval Injection

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to improper neutralization of directives in dynamically evaluated code in the Invitation application when processing a crafted URL parameter in a view request. A remote user can craft a URL with a dangerous payload to execute arbitrary code.

The issue can be triggered by a user with view rights on any document.


40) Eval Injection (CVE-ID: CVE-2023-29523)

CWE-ID: CWE-95 - Eval Injection

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to improper neutralization of directives in dynamically evaluated code in the display method used in user profiles when rendering a document field with wiki syntax. A remote user can edit their own user profile to execute arbitrary code.

The issue can also be exploited in other contexts where the display method on a document is used to display a field with wiki syntax, including applications created using App Within Minutes.


41) Eval Injection (CVE-ID: CVE-2023-29522)

CWE-ID: CWE-95 - Eval Injection

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to improper neutralization of directives in dynamically evaluated code in XWiki.ClassSheet when rendering a non-existing page with a crafted page name. A remote user can open a specially crafted URL to execute arbitrary code.

The issue can expose unrestricted read and write access to all wiki contents.


42) Eval Injection (CVE-ID: CVE-2023-29521)

CWE-ID: CWE-95 - Eval Injection

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to improper neutralization of directives in dynamically evaluated code in Macro.VFSTreeMacro when rendering the VFS Tree macro. A remote user can execute arbitrary Groovy, Python or Velocity code to execute arbitrary code.

The vulnerable page is not installed by default.


43) Information disclosure (CVE-ID: CVE-2023-34466)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to exposure of sensitive information in the tags API when handling requests for tags on non-viewable pages. A remote user can query tags for non-viewable pages to disclose sensitive information.

The leaked information can also be used to infer the document reference of non-viewable pages.


44) Uncaught Exception (CVE-ID: CVE-2023-29520)

CWE-ID: CWE-248 - Uncaught Exception

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to modify translations.

The vulnerability exists due to uncaught exception in the wiki localization source when loading a corrupted document containing a translation object. A remote user can create such a document to modify translations.


45) Eval Injection (CVE-ID: CVE-2023-29518)

CWE-ID: CWE-95 - Eval Injection

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to improper neutralization of directives in dynamically evaluated code in Invitation.InvitationCommon when processing user-controlled content. A remote user can inject arbitrary Groovy, Python, or Velocity code to execute arbitrary code.

This page is installed by default.


46) Information disclosure (CVE-ID: CVE-2023-29517)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to exposure of sensitive information in the office document viewer macro when handling document viewing requests through a connected office server. A remote attacker can access file contents from the hosting server to disclose sensitive information.

The issue depends on the office server being connected, and the accessible data depends on the permissions of the user running the servlet engine hosting XWiki.


47) Eval Injection (CVE-ID: CVE-2023-29516)

CWE-ID: CWE-95 - Eval Injection

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to improper neutralization of directives in dynamically evaluated code in the XWiki.AttachmentSelector page when processing the "Cancel and return to page" button input. A remote user can send a specially crafted value to execute arbitrary code.

This page is installed by default.


48) Incorrect Privilege Assignment (CVE-ID: CVE-2023-29515)

CWE-ID: CWE-266 - Incorrect Privilege Assignment

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to inject malicious JavaScript.

The vulnerability exists due to incorrect privilege assignment in App Within Minutes when creating an app. A remote user can create an app or directly open the CreateApplication wizard endpoint to inject malicious JavaScript.

The issue occurs because creating an app can grant space admin rights, which imply script rights.


49) Eval Injection (CVE-ID: CVE-2023-29514)

CWE-ID: CWE-95 - Eval Injection

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to improper neutralization of directives in dynamically evaluated code in template provider administration when processing document titles in the administration template listing. A remote user can set a crafted document title, add an XWiki.TemplateProviderClass object to a document they can edit, and access the administration templates sheet to execute arbitrary code.

Exploitation requires edit rights on a document and the ability to add a Template Provider Class object.


50) Improper access control (CVE-ID: CVE-2023-29513)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to create a new user account even when registration is disabled.

The vulnerability exists due to improper access control in the distribution/firstadminuser.wiki template macro when rendering the template in the wrong context. A remote user can invoke the template through a crafted request to create a new user account even when registration is disabled.

Exploitation requires guest view rights on at least one document, and on installations starting with XWiki 14.5 a valid CSRF token is also required.


51) Eval Injection (CVE-ID: CVE-2023-29512)

CWE-ID: CWE-95 - Eval Injection

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to improper neutralization of directives in dynamically evaluated code in imported.vm, importinline.vm, and packagelist.vm when loading information from attachments. A remote user can place crafted attachment content on a page they can edit to execute arbitrary code.

The affected page is installed by default, and successful exploitation can lead to full access to the XWiki installation.


52) Eval Injection (CVE-ID: CVE-2023-29511)

CWE-ID: CWE-95 - Eval Injection

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to improper neutralization of directives in dynamically evaluated code in XWiki.AdminFieldsDisplaySheet when processing section ids. A remote user can inject crafted section ids to execute arbitrary code.

The issue can lead to full access to the XWiki installation, and the affected page is installed by default.


53) Eval Injection (CVE-ID: CVE-2023-29510)

CWE-ID: CWE-95 - Eval Injection

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to improper neutralization of directives in dynamically evaluated code in the localization script when processing user-scoped translations in privileged contexts without escaping. A remote user can add a crafted translation that overrides an existing translation to execute arbitrary code.

Exploitation requires edit access on at least one document, which can be the user's own profile where edit access is enabled by default.


54) Eval Injection (CVE-ID: CVE-2023-30537)

CWE-ID: CWE-95 - Eval Injection

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to improper neutralization of directives in dynamically evaluated code in FlamingoThemesCode.WebHomeSheet when rendering theme style properties from user-controlled objects. A remote user can add a crafted Theme Class object with malicious style content to execute arbitrary code.

The vulnerable page is installed by default, and exploitation requires the right to add an object on a page.


55) Eval Injection (CVE-ID: CVE-2023-29509)

CWE-ID: CWE-95 - Eval Injection

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to improper neutralization of directives in dynamically evaluated code in the documentTree macro parameters in FlamingoThemesCode.WebHome when processing a crafted request URL. A remote user can supply crafted macro input to execute arbitrary code.

The issue can lead to privilege escalation from view rights to programming rights, resulting in full access to the XWiki installation.


56) Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) (CVE-ID: CVE-2023-29508)

CWE-ID: CWE-80 - Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to execute arbitrary script in a victim's browser.

The vulnerability exists due to improper neutralization of script-related html tags in the Live Data macro when rendering user-controlled HTML content. A remote user can inject crafted content to execute arbitrary script in a victim's browser.

Exploitation requires user interaction and occurs if the last author of the page content has script rights.


57) Incorrect Use of Privileged APIs (CVE-ID: CVE-2023-29507)

CWE-ID: CWE-648 - Incorrect Use of Privileged APIs

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to escalate privileges.

The vulnerability exists due to incorrect use of privileged APIs in the Document script API when returning a DocumentAuthors object to scripts. A remote privileged user can set arbitrary document authors to escalate privileges.

This can lead to subsequent script executions being evaluated with the modified author for rights checking.


58) Cross-site scripting (CVE-ID: CVE-2023-29506)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to execute arbitrary script code in the victim's browser.

The vulnerability exists due to cross-site scripting in authenticate endpoints when handling a crafted authenticate endpoint URL. A remote attacker can send a specially crafted URL to execute arbitrary script code in the victim's browser.

User interaction is required to open the crafted URL.


59) Incorrect authorization (CVE-ID: CVE-2024-38369)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to impersonate the author of content using the include macro.

The vulnerability exists due to incorrect authorization in the include macro when executing content from an included document. A remote user can modify the target document to impersonate the author of content using the include macro.

The included content is executed with the rights of the includer instead of the rights of its author.


60) XML External Entity injection (CVE-ID: CVE-2023-27480)

CWE-ID: CWE-611 - Improper Restriction of XML External Entity Reference ('XXE')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper restriction of XML external entity reference in the XAR import package.xml parser when parsing a forged XAR file during import. A remote user can upload a specially crafted XAR file and trigger its import to disclose sensitive information.

Exploitation requires edit rights on a document and can expose the content of files on the XWiki server host.


61) Eval Injection (CVE-ID: CVE-2023-29214)

CWE-ID: CWE-95 - Eval Injection

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to improper neutralization of directives in dynamically evaluated code in the IncludedDocuments panel when processing included page content. A remote user can edit a document containing crafted directives to execute arbitrary code.

Exploitation requires edit rights and the Panels.IncludedDocuments panel to be added on a column by an administrator.


62) Eval Injection (CVE-ID: CVE-2023-29213)

CWE-ID: CWE-95 - Eval Injection

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to improper neutralization of directives in dynamically evaluated code in the logging administration interface when handling crafted logger_name parameters in requests to the LoggingAdmin page. A remote user can trick a user with programming rights into visiting a specially crafted URL to execute arbitrary code.

User interaction is required, and exploitation depends on a user with programming rights visiting the crafted URL.


63) Eval Injection (CVE-ID: CVE-2023-29212)

CWE-ID: CWE-95 - Eval Injection

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to improper neutralization of directives in dynamically evaluated code in the IncludedPagesDocumentInformation included documents edit panel when rendering included pages. A remote user can edit a document containing specially crafted content to execute arbitrary code.

This can lead to full access to the XWiki installation.


64) Eval Injection (CVE-ID: CVE-2023-29211)

CWE-ID: CWE-95 - Eval Injection

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to improper neutralization of directives in dynamically evaluated code in the WikiManager.DeleteWiki functionality when processing the wikiId URL parameter. A remote user can send a specially crafted request to execute arbitrary code.

Exploitation requires view rights on WikiManager.DeleteWiki.


65) Eval Injection (CVE-ID: CVE-2023-27479)

CWE-ID: CWE-95 - Eval Injection

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to execute arbitrary Groovy, Python or Velocity code.

The vulnerability exists due to improper neutralization of directives in dynamically evaluated code in UIX parameter handling in PanelsCode.ApplicationsPanelConfigurationSheet when processing extension parameters. A remote user can add an XWiki.UIExtensionClass xobject with crafted extension parameters to execute arbitrary Groovy, Python or Velocity code.

Exploitation requires view rights.


66) Eval Injection (CVE-ID: CVE-2023-29210)

CWE-ID: CWE-95 - Eval Injection

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to improper neutralization of directives in dynamically evaluated code in the notification preferences macros when processing the user parameter. A remote user can inject crafted macro input to execute arbitrary code.

The affected macros are used in user profiles and are installed by default in XWiki.


67) Eval Injection (CVE-ID: CVE-2023-29209)

CWE-ID: CWE-95 - Eval Injection

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to improper neutralization of directives in dynamically evaluated code in the legacy notification activity macro when processing crafted macro parameters. A remote user can supply crafted macro input to execute arbitrary code.

The issue can be exploited through editable wiki pages, and it can also be reached with only view rights via the HTMLConverter in the bundled CKEditor integration.


68) Exposure of Resource to Wrong Sphere (CVE-ID: CVE-2023-29208)

CWE-ID: CWE-668 - Exposure of resource to wrong sphere

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper access control in deleted document view handling when viewing deleted documents. A remote attacker can access a deleted document containing view rights to disclose sensitive information.

Only deleted documents that contain view rights are affected; view rights provided on a space of a deleted document are properly checked.


69) Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) (CVE-ID: CVE-2023-29207)

CWE-ID: CWE-80 - Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to execute arbitrary actions in the wiki.

The vulnerability exists due to improper neutralization of script-related html tags in the LiveTable Macro when rendering user-controlled column names. A remote user can inject crafted HTML or JavaScript through macro parameters to execute arbitrary actions in the wiki.

This issue is also exploitable via the Documents Macro and can be triggered in comments. User interaction is required by a user with more rights.


70) Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) (CVE-ID: CVE-2023-26480)

CWE-ID: CWE-80 - Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to execute arbitrary script in a victim's browser.

The vulnerability exists due to improper neutralization of script-related HTML tags in the HTML displayer in the Live Data macro when rendering user-supplied HTML content. A remote user can inject a specially crafted Live Data entry to execute arbitrary script in a victim's browser.

User interaction is required to view the crafted content.


71) Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) (CVE-ID: CVE-2023-29205)

CWE-ID: CWE-80 - Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to execute arbitrary script in a victim's browser.

The vulnerability exists due to improper neutralization of script-related html tags in the HTML macro when rendering user-supplied HTML content. A remote user can create content containing malicious script-related HTML tags to execute arbitrary script in a victim's browser.

In a standard wiki, any user is able to use the HTML macro directly in their own user profile page.


72) Open redirect (CVE-ID: CVE-2023-29204)

CWE-ID: CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to redirect users to an untrusted site.

The vulnerability exists due to url redirection to an untrusted site in redirect handling in xwiki-platform-oldcore when processing crafted redirect URLs. A remote attacker can supply a redirect value such as //mydomain.com or http:/mydomain.com to redirect users to an untrusted site.

User interaction is required.


73) Exposure of Private Information ('Privacy Violation') (CVE-ID: CVE-2023-29203)

CWE-ID: CWE-359 - Exposure of Private Information ('Privacy Violation')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote attacker to disclose private personal information.

The vulnerability exists due to improper access control in uorgsuggest.vm when requesting users on a subwiki that allows only global users. A remote attacker can send a crafted request to disclose private personal information.

Only hidden users from the main wiki are affected, and the disclosed information is limited to usernames and first and last names.


74) Exposure of Private Information ('Privacy Violation') (CVE-ID: CVE-2022-41936)

CWE-ID: CWE-359 - Exposure of Private Information ('Privacy Violation')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper access control in the modifications rest endpoint when handling requests. A remote attacker can send a request to disclose sensitive information.

Exposed information can include comments and page names that should be hidden from unauthorized users.


75) Information disclosure (CVE-ID: CVE-2022-41935)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to exposure of sensitive information to an unauthorized actor in the LiveTable results endpoint when processing repeated Livetable queries for restricted documents. A remote attacker can send specially crafted queries to disclose sensitive information.

By iteratively refining query terms, an attacker can infer the existence of restricted documents and recover portions of their title, content, or XObject properties.


76) Cross-site scripting (CVE-ID: CVE-2023-29202)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear


The vulnerability allows a remote user to execute arbitrary actions in the wiki.

The vulnerability exists due to cross-site scripting in the RSS macro HTML output when rendering feed item content from an attacker-controlled RSS feed with the content parameter set to true. A remote user can specify a malicious RSS feed to execute arbitrary actions in the wiki.

User interaction is required, and exploitation becomes particularly severe if a user with programming rights views the page.


77) Eval Injection (CVE-ID: CVE-2022-41934)

CWE-ID: CWE-95 - Eval Injection

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to improper neutralization of directives in dynamically evaluated code in the menu macro when processing macro content and parameters. A remote user can inject crafted Groovy, Python, or Velocity code to execute arbitrary code.

The issue affects commonly accessible documents that include the menu macro and can lead to full access to the XWiki installation.


78) Missing Authorization (CVE-ID: CVE-2022-41937)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to modify any page of the wiki.

The vulnerability exists due to missing authorization in the filter stream converter application when importing a crafted XAR package. A remote user can import a crafted XAR package to modify any page of the wiki.

Exploitation requires view access.


79) Unprotected storage of credentials (CVE-ID: CVE-2022-41933)

CWE-ID: CWE-256 - Unprotected Storage of Credentials

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to plaintext storage of a password in the password reset feature when processing a forgotten password reset. A remote privileged user can trigger a password reset and obtain the password from the database to disclose sensitive information.

Only the reset password feature reachable from the "Forgot your password" link is affected, and the issue concerns users of the main wiki rather than subwiki users in farm deployments.


80) Resource exhaustion (CVE-ID: CVE-2022-41932)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in the login form when processing a crafted user identifier. A remote attacker can submit a crafted user identifier to cause a denial of service.

This issue affects deployments using PostgreSQL.


81) Eval Injection (CVE-ID: CVE-2022-41931)

CWE-ID: CWE-95 - Eval Injection

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to execute arbitrary Groovy, Python or Velocity code in XWiki.

The vulnerability exists due to improper neutralization of directives in dynamically evaluated code in the icon picker macro when processing macro parameters. A remote user can supply crafted macro parameter values to execute arbitrary Groovy, Python or Velocity code in XWiki.

Exploitation requires view rights on commonly accessible documents that include the icon picker macro.


82) Missing Authorization (CVE-ID: CVE-2022-41929)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to modify user account status.

The vulnerability exists due to missing authorization in User#setDisabledStatus when handling requests to enable or disable a user. A remote privileged user can invoke the affected method to modify user account status.

Only users with Script rights can exploit this issue, even though enabling or disabling users should require admin rights.


83) Missing Authorization (CVE-ID: CVE-2022-41930)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to enable or disable user profiles.

The vulnerability exists due to missing authorization in XWiki.XWikiUserProfileSheet when handling requests to change user profile status. A remote attacker can send a crafted request to enable or disable any user profile.

This can allow a disabled user to re-enable themselves.


84) Eval Injection (CVE-ID: CVE-2022-41928)

CWE-ID: CWE-95 - Eval Injection

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to improper neutralization of directives in dynamically evaluated code in AttachmentSelector.xml when rendering attachment metadata or macro properties. A remote user can supply a crafted attachment name or crafted macro property values to execute arbitrary code.

The issue can be triggered through the width, height, or alt properties of the attachmentSelector macro, and can also be reached through attachment renaming in a user profile.


85) Cross-site request forgery (CVE-ID: CVE-2022-41927)

CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to delete or rename tags.

The vulnerability exists due to cross-site request forgery (CSRF) in the tag UI when handling requests to delete or rename tags. A remote attacker can send a specially crafted request to delete or rename tags.

User interaction is required.


Remediation

Install update from vendor's website.

References