Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:maven/org.xwiki.platform/xwiki-platform-oldcore@3.0.1
Typemaven
Namespaceorg.xwiki.platform
Namexwiki-platform-oldcore
Version3.0.1
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version12.10.6
Latest_non_vulnerable_version15.10-rc-1
Affected_by_vulnerabilities
0
url VCID-xevu-xntb-vufs
vulnerability_id VCID-xevu-xntb-vufs
summary 
XWiki Platform: Privilege escalation (PR) from user registration through PDFClass
Remote code execution is possible via PDF export templates.
To reproduce on an installation, register a new user account with username `PDFClass` if `XWiki.PDFClass` does not exist.
On `XWiki.PDFClass`, use the class editor to add a "style" property of type "TextArea" and content type "Plain Text".
Then, add an object of class `PDFClass` and set the "style" attribute to `$services.logging.getLogger('PDFClass').error("I got programming: $services.security.authorization.hasAccess('programming')")`.
Finally, go to `<host>/xwiki/bin/export/Main/WebHome?format=pdf&pdftemplate=XWiki.PDFClass`. If the logs contain "ERROR PDFClass - I got programming: true", the instance is vulnerable.
references
0
reference_url https://github.com/xwiki/xwiki-platform
reference_id
reference_type
scores
url https://github.com/xwiki/xwiki-platform
1
reference_url https://github.com/xwiki/xwiki-platform/commit/480186f9d2fca880513da8bc5a609674d106cbd3
reference_id
reference_type
scores
url https://github.com/xwiki/xwiki-platform/commit/480186f9d2fca880513da8bc5a609674d106cbd3
2
reference_url https://github.com/xwiki/xwiki-platform/commit/a4ad14d9c1605a5ab957237e505ebbb29f5b9d73
reference_id
reference_type
scores
url https://github.com/xwiki/xwiki-platform/commit/a4ad14d9c1605a5ab957237e505ebbb29f5b9d73
3
reference_url https://github.com/xwiki/xwiki-platform/commit/d28e21a670c69880b951e415dd2ddd69d273eae9
reference_id
reference_type
scores
url https://github.com/xwiki/xwiki-platform/commit/d28e21a670c69880b951e415dd2ddd69d273eae9
4
reference_url https://jira.xwiki.org/browse/XWIKI-21337
reference_id
reference_type
scores
url https://jira.xwiki.org/browse/XWIKI-21337
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2024-31981
reference_id CVE-2024-31981
reference_type
scores
url https://nvd.nist.gov/vuln/detail/CVE-2024-31981
6
reference_url https://github.com/advisories/GHSA-vxwr-wpjv-qjq7
reference_id GHSA-vxwr-wpjv-qjq7
reference_type
scores
url https://github.com/advisories/GHSA-vxwr-wpjv-qjq7
7
reference_url https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-vxwr-wpjv-qjq7
reference_id GHSA-vxwr-wpjv-qjq7
reference_type
scores
url https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-vxwr-wpjv-qjq7
fixed_packages
0
url pkg:maven/org.xwiki.platform/xwiki-platform-oldcore@14.10.20
purl pkg:maven/org.xwiki.platform/xwiki-platform-oldcore@14.10.20
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.xwiki.platform/xwiki-platform-oldcore@14.10.20
1
url pkg:maven/org.xwiki.platform/xwiki-platform-oldcore@15.5.4
purl pkg:maven/org.xwiki.platform/xwiki-platform-oldcore@15.5.4
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.xwiki.platform/xwiki-platform-oldcore@15.5.4
2
url pkg:maven/org.xwiki.platform/xwiki-platform-oldcore@15.10-rc-1
purl pkg:maven/org.xwiki.platform/xwiki-platform-oldcore@15.10-rc-1
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.xwiki.platform/xwiki-platform-oldcore@15.10-rc-1
aliases CVE-2024-31981, GHSA-vxwr-wpjv-qjq7
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-xevu-xntb-vufs
Fixing_vulnerabilities
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:maven/org.xwiki.platform/xwiki-platform-oldcore@3.0.1