Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:maven/org.xwiki.platform/xwiki-platform-oldcore@15.0
Typemaven
Namespaceorg.xwiki.platform
Namexwiki-platform-oldcore
Version15.0
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version15.1-rc-1
Latest_non_vulnerable_version15.10-rc-1
Affected_by_vulnerabilities
0
url VCID-9pzc-wwmb-9ba9
vulnerability_id VCID-9pzc-wwmb-9ba9
summary 
XWiki Platform vulnerable to privilege escalation and remote code execution via the edit action
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible for a user to execute any content with the right of an existing document's content author, provided the user have edit right on it. A crafted URL of the form ` /xwiki/bin/edit//?content=%7B%7Bgroovy%7D%7Dprintln%28%22Hello+from+ Groovy%21%22%29%7B%7B%2Fgroovy%7D%7D&xpage=view` can be used to execute arbitrary groovy code on the server. This vulnerability has been patched in XWiki versions 14.10.6 and 15.2RC1. Users are advised to update. There are no known workarounds for this issue.
references
0
reference_url https://github.com/xwiki/xwiki-platform/commit/a0e6ca083b36be6f183b9af33ae735c1e02010f4
reference_id
reference_type
scores
url https://github.com/xwiki/xwiki-platform/commit/a0e6ca083b36be6f183b9af33ae735c1e02010f4
1
reference_url https://jira.xwiki.org/browse/XWIKI-20385
reference_id
reference_type
scores
url https://jira.xwiki.org/browse/XWIKI-20385
2
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-46243
reference_id CVE-2023-46243
reference_type
scores
url https://nvd.nist.gov/vuln/detail/CVE-2023-46243
3
reference_url https://github.com/advisories/GHSA-g2qq-c5j9-5w5w
reference_id GHSA-g2qq-c5j9-5w5w
reference_type
scores
url https://github.com/advisories/GHSA-g2qq-c5j9-5w5w
4
reference_url https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-g2qq-c5j9-5w5w
reference_id GHSA-g2qq-c5j9-5w5w
reference_type
scores
url https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-g2qq-c5j9-5w5w
fixed_packages
0
url pkg:maven/org.xwiki.platform/xwiki-platform-oldcore@15.2-rc-1
purl pkg:maven/org.xwiki.platform/xwiki-platform-oldcore@15.2-rc-1
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.xwiki.platform/xwiki-platform-oldcore@15.2-rc-1
aliases CVE-2023-46243, GHSA-g2qq-c5j9-5w5w
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-9pzc-wwmb-9ba9
1
url VCID-r7z4-z529-d7cb
vulnerability_id VCID-r7z4-z529-d7cb
summary 
Cross-Site Request Forgery (CSRF)
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible to execute a content with the right of any user via a crafted URL. A user must have `programming` privileges in order to exploit this vulnerability. This issue has been patched in XWiki 14.10.7 and 15.2RC1. Users are advised to upgrade. There are no known workarounds for for this vulnerability.
references
0
reference_url https://github.com/xwiki/xwiki-platform/commit/cf8eb861998ea423c3645d2e5e974420b0e882be
reference_id
reference_type
scores
url https://github.com/xwiki/xwiki-platform/commit/cf8eb861998ea423c3645d2e5e974420b0e882be
1
reference_url https://jira.xwiki.org/browse/XWIKI-20386
reference_id
reference_type
scores
url https://jira.xwiki.org/browse/XWIKI-20386
2
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-46242
reference_id CVE-2023-46242
reference_type
scores
url https://nvd.nist.gov/vuln/detail/CVE-2023-46242
3
reference_url https://github.com/advisories/GHSA-hgpw-6p4h-j6h5
reference_id GHSA-hgpw-6p4h-j6h5
reference_type
scores
url https://github.com/advisories/GHSA-hgpw-6p4h-j6h5
4
reference_url https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-hgpw-6p4h-j6h5
reference_id GHSA-hgpw-6p4h-j6h5
reference_type
scores
url https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-hgpw-6p4h-j6h5
fixed_packages
0
url pkg:maven/org.xwiki.platform/xwiki-platform-oldcore@15.2-rc-1
purl pkg:maven/org.xwiki.platform/xwiki-platform-oldcore@15.2-rc-1
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.xwiki.platform/xwiki-platform-oldcore@15.2-rc-1
aliases CVE-2023-46242, GHSA-hgpw-6p4h-j6h5
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-r7z4-z529-d7cb
Fixing_vulnerabilities
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:maven/org.xwiki.platform/xwiki-platform-oldcore@15.0