VulnerableCode Package Details - pkg:maven/org.xwiki.platform/xwiki-platform-oldcore@13.0.0

Search for packages

Vulnerability	Summary	Fixed by
VCID-115a-j3ec-fkas Aliases: CVE-2022-23618 GHSA-jp55-vvmf-63mv	URL Redirection to Untrusted Site ('Open Redirect') XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions there is no protection against URL redirection to untrusted sites, in particular some well known parameters (xredirect) can be used to perform url redirections. This problem has been patched in XWiki 12.10.7 and XWiki 13.3RC1. Users are advised to update. There are no known workarounds for this issue.	13.3RC1 Affected by 0 other vulnerabilities.
VCID-qt8r-6rqv-tkhu Aliases: CVE-2022-23621 GHSA-2jhm-qp48-hv5j	Missing Authorization XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with SCRIPT right can read any file located in the XWiki WAR (for example xwiki.cfg and xwiki.properties) through XWiki#invokeServletAndReturnAsString as `$xwiki.invokeServletAndReturnAsString("/WEB-INF/xwiki.cfg")`. This issue has been patched in XWiki versions 12.10.9, 13.4.3 and 13.7-rc-1. Users are advised to update. The only workaround is to limit SCRIPT right.	13.4.3 Affected by 0 other vulnerabilities. 13.7-rc-1 Affected by 0 other vulnerabilities.

Vulnerability

Summary

Fixed by

VCID-115a-j3ec-fkas
Aliases:
CVE-2022-23618
GHSA-jp55-vvmf-63mv

URL Redirection to Untrusted Site ('Open Redirect') XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions there is no protection against URL redirection to untrusted sites, in particular some well known parameters (xredirect) can be used to perform url redirections. This problem has been patched in XWiki 12.10.7 and XWiki 13.3RC1. Users are advised to update. There are no known workarounds for this issue.

13.3RC1
Affected by 0 other vulnerabilities.

VCID-qt8r-6rqv-tkhu
Aliases:
CVE-2022-23621
GHSA-2jhm-qp48-hv5j

Missing Authorization XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with SCRIPT right can read any file located in the XWiki WAR (for example xwiki.cfg and xwiki.properties) through XWiki#invokeServletAndReturnAsString as `$xwiki.invokeServletAndReturnAsString("/WEB-INF/xwiki.cfg")`. This issue has been patched in XWiki versions 12.10.9, 13.4.3 and 13.7-rc-1. Users are advised to update. The only workaround is to limit SCRIPT right.

13.4.3
Affected by 0 other vulnerabilities.

13.7-rc-1
Affected by 0 other vulnerabilities.

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Vulnerability

Summary

Aliases

This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-04-01T15:59:31.872808+00:00	GHSA Importer	Affected by	VCID-qt8r-6rqv-tkhu	https://github.com/advisories/GHSA-2jhm-qp48-hv5j	38.0.0
2026-04-01T15:59:31.646034+00:00	GHSA Importer	Affected by	VCID-115a-j3ec-fkas	https://github.com/advisories/GHSA-jp55-vvmf-63mv	38.0.0
2026-04-01T12:49:25.579904+00:00	GitLab Importer	Affected by	VCID-115a-j3ec-fkas	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.xwiki.platform/xwiki-platform-oldcore/CVE-2022-23618.yml	38.0.0