VulnerableCode Package Details - pkg:maven/org.xwiki.platform/xwiki-platform-oldcore@13.2

Search for packages

Vulnerability	Summary	Fixed by
VCID-115a-j3ec-fkas Aliases: CVE-2022-23618 GHSA-jp55-vvmf-63mv	URL Redirection to Untrusted Site ('Open Redirect') XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions there is no protection against URL redirection to untrusted sites, in particular some well known parameters (xredirect) can be used to perform url redirections. This problem has been patched in XWiki 12.10.7 and XWiki 13.3RC1. Users are advised to update. There are no known workarounds for this issue.	13.3RC1 Affected by 0 other vulnerabilities.
VCID-yxrz-ypx2-q7hh Aliases: CVE-2021-43841 GHSA-9jq9-c2cv-pcrj	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') XWiki is a generic wiki platform offering runtime services for applications built on top of it. When using default XWiki configuration, it's possible for an attacker to upload an SVG containing a script executed when executing the download action on the file. This problem has been patched so that the default configuration does not allow to display the SVG files in the browser. Users are advised to update or to disallow uploads of SVG files.	13.3RC1 Affected by 0 other vulnerabilities.

Vulnerability

Summary

Fixed by

VCID-115a-j3ec-fkas
Aliases:
CVE-2022-23618
GHSA-jp55-vvmf-63mv

URL Redirection to Untrusted Site ('Open Redirect') XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions there is no protection against URL redirection to untrusted sites, in particular some well known parameters (xredirect) can be used to perform url redirections. This problem has been patched in XWiki 12.10.7 and XWiki 13.3RC1. Users are advised to update. There are no known workarounds for this issue.

13.3RC1
Affected by 0 other vulnerabilities.

VCID-yxrz-ypx2-q7hh
Aliases:
CVE-2021-43841
GHSA-9jq9-c2cv-pcrj

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') XWiki is a generic wiki platform offering runtime services for applications built on top of it. When using default XWiki configuration, it's possible for an attacker to upload an SVG containing a script executed when executing the download action on the file. This problem has been patched so that the default configuration does not allow to display the SVG files in the browser. Users are advised to update or to disallow uploads of SVG files.

13.3RC1
Affected by 0 other vulnerabilities.

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Vulnerability

Summary

Aliases

This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-04-01T15:59:51.814535+00:00	GHSA Importer	Affected by	VCID-yxrz-ypx2-q7hh	https://github.com/advisories/GHSA-9jq9-c2cv-pcrj	38.0.0
2026-04-01T15:59:31.649322+00:00	GHSA Importer	Affected by	VCID-115a-j3ec-fkas	https://github.com/advisories/GHSA-jp55-vvmf-63mv	38.0.0
2026-04-01T12:49:31.231925+00:00	GitLab Importer	Affected by	VCID-yxrz-ypx2-q7hh	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.xwiki.platform/xwiki-platform-oldcore/CVE-2021-43841.yml	38.0.0
2026-04-01T12:49:25.582345+00:00	GitLab Importer	Affected by	VCID-115a-j3ec-fkas	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.xwiki.platform/xwiki-platform-oldcore/CVE-2022-23618.yml	38.0.0