Search for packages
| purl | pkg:maven/org.xwiki.platform/xwiki-platform-oldcore@13.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-6xht-gkrh-v7fg
Aliases: CVE-2022-23617 GHSA-gf7x-2j2x-7f73 |
Missing Authorization XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with edit right can copy the content of a page it does not have access to by using it as template of a new page. This issue has been patched in XWiki 13.2CR1 and 12.10.6. Users are advised to update. There are no known workarounds for this issue. |
Affected by 0 other vulnerabilities. |
|
VCID-yxrz-ypx2-q7hh
Aliases: CVE-2021-43841 GHSA-9jq9-c2cv-pcrj |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') XWiki is a generic wiki platform offering runtime services for applications built on top of it. When using default XWiki configuration, it's possible for an attacker to upload an SVG containing a script executed when executing the download action on the file. This problem has been patched so that the default configuration does not allow to display the SVG files in the browser. Users are advised to update or to disallow uploads of SVG files. |
Affected by 0 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-q5t9-725x-dkb1 | Partial authorization bypass on document save in xwiki-platform XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with SCRIPT right can save a document with the right of the current user which allow accessing API requiring programming right if the current user has programming right. This has been patched in XWiki 13.0. Users are advised to update to resolve this issue. The only known workaround is to limit SCRIPT access. |
CVE-2022-23615
GHSA-f4cj-3q3h-884r |