Package Instance
Lookup for vulnerable packages by Package URL.
GET /api/packages/64127?format=api
{ "url": "http://public2.vulnerablecode.io/api/packages/64127?format=api", "purl": "pkg:maven/org.xwiki.platform/xwiki-platform-livedata-macro@14.4.7", "type": "maven", "namespace": "org.xwiki.platform", "name": "xwiki-platform-livedata-macro", "version": "14.4.7", "qualifiers": {}, "subpath": "", "is_vulnerable": false, "next_non_vulnerable_version": "14.10", "latest_non_vulnerable_version": "14.10", "affected_by_vulnerabilities": [], "fixing_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/44573?format=api", "vulnerability_id": "VCID-16tw-rke6-7bdp", "summary": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\nXWiki Platform is a generic wiki platform. Starting in version 12.10, a user without script rights can introduce a stored cross-site scripting by using the Live Data macro. This has been patched in XWiki 14.9, 14.4.7, and 13.10.10. There are no known workarounds.", "references": [ { "reference_url": "https://github.com/xwiki/xwiki-platform/commit/23d5ea9b23e84b5f3d1f1b2d5673fe8c774d0d79", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/xwiki/xwiki-platform/commit/23d5ea9b23e84b5f3d1f1b2d5673fe8c774d0d79" }, { "reference_url": "https://github.com/xwiki/xwiki-platform/commit/556e7823260b826f344c1a6e95d935774587e028", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/xwiki/xwiki-platform/commit/556e7823260b826f344c1a6e95d935774587e028" }, { "reference_url": "https://jira.xwiki.org/browse/XWIKI-20143", "reference_id": "", "reference_type": "", "scores": [], "url": "https://jira.xwiki.org/browse/XWIKI-20143" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2023-26480", "reference_id": "CVE-2023-26480", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-26480" }, { "reference_url": "https://github.com/advisories/GHSA-32fq-m2q5-h83g", "reference_id": "GHSA-32fq-m2q5-h83g", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-32fq-m2q5-h83g" }, { "reference_url": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-32fq-m2q5-h83g", "reference_id": "GHSA-32fq-m2q5-h83g", "reference_type": "", "scores": [], "url": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-32fq-m2q5-h83g" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/64126?format=api", "purl": "pkg:maven/org.xwiki.platform/xwiki-platform-livedata-macro@13.10.10", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-cawb-zpmc-b3dp" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.xwiki.platform/xwiki-platform-livedata-macro@13.10.10" }, { "url": "http://public2.vulnerablecode.io/api/packages/64127?format=api", "purl": "pkg:maven/org.xwiki.platform/xwiki-platform-livedata-macro@14.4.7", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.xwiki.platform/xwiki-platform-livedata-macro@14.4.7" }, { "url": "http://public2.vulnerablecode.io/api/packages/64128?format=api", "purl": "pkg:maven/org.xwiki.platform/xwiki-platform-livedata-macro@14.9", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-cawb-zpmc-b3dp" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.xwiki.platform/xwiki-platform-livedata-macro@14.9" } ], "aliases": [ "CVE-2023-26480", "GHSA-32fq-m2q5-h83g" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-16tw-rke6-7bdp" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/44924?format=api", "vulnerability_id": "VCID-cawb-zpmc-b3dp", "summary": "org.xwiki.platform:xwiki-platform-livedata-macro vulnerable to Basic Cross-site Scripting\nA user without script rights can introduce a stored XSS by using the Live Data macro, if the last author of the content of the page has script rights.\n\nFor instance, by adding the LiveData below in the about section of the profile of a user created by an admin.\n\n```javascript\n{{liveData id=\"movies\" properties=\"title,description\"}}\n{\n\"data\": {\n\"count\": 1,\n\"entries\": [\n{\n\"title\": \"Meet John Doe\",\n\"url\": \"https://www.imdb.com/title/tt0033891/\",\n\"description\": \"<img onerror='alert(1)' src='foo' />\"\n}\n]\n},\n\"meta\": {\n\"propertyDescriptors\": [\n{\n\"id\": \"title\",\n\"name\": \"Title\",\n\"visible\": true,\n\"displayer\": {\"id\": \"link\", \"propertyHref\": \"url\"}\n},\n{\n\"id\": \"description\",\n\"name\": \"Description\",\n\"visible\": true,\n\"displayer\": \"html\"\n}\n]\n}\n}\n{{/liveData}}\n```", "references": [ { "reference_url": "https://github.com/xwiki/xwiki-platform", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/xwiki/xwiki-platform" }, { "reference_url": "https://jira.xwiki.org/browse/XWIKI-20312", "reference_id": "", "reference_type": "", "scores": [], "url": "https://jira.xwiki.org/browse/XWIKI-20312" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2023-29508", "reference_id": "CVE-2023-29508", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-29508" }, { "reference_url": "https://github.com/advisories/GHSA-hmm7-6ph9-8jf2", "reference_id": "GHSA-hmm7-6ph9-8jf2", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-hmm7-6ph9-8jf2" }, { "reference_url": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-hmm7-6ph9-8jf2", "reference_id": "GHSA-hmm7-6ph9-8jf2", "reference_type": "", "scores": [], "url": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-hmm7-6ph9-8jf2" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/64661?format=api", "purl": "pkg:maven/org.xwiki.platform/xwiki-platform-livedata-macro@13.10.11", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.xwiki.platform/xwiki-platform-livedata-macro@13.10.11" }, { "url": "http://public2.vulnerablecode.io/api/packages/64127?format=api", "purl": "pkg:maven/org.xwiki.platform/xwiki-platform-livedata-macro@14.4.7", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.xwiki.platform/xwiki-platform-livedata-macro@14.4.7" }, { "url": "http://public2.vulnerablecode.io/api/packages/64662?format=api", "purl": "pkg:maven/org.xwiki.platform/xwiki-platform-livedata-macro@14.10", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.xwiki.platform/xwiki-platform-livedata-macro@14.10" } ], "aliases": [ "CVE-2023-29508", "GHSA-hmm7-6ph9-8jf2" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-cawb-zpmc-b3dp" } ], "risk_score": null, "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.xwiki.platform/xwiki-platform-livedata-macro@14.4.7" }