Search for packages
| purl | pkg:maven/org.xwiki.platform/xwiki-platform-oldcore@3.2-milestone-3 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-3ksc-nvrc-6ub3
Aliases: CVE-2023-40572 GHSA-4f8m-7h83-9f6m |
Cross-Site Request Forgery (CSRF) XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The create action is vulnerable to a CSRF attack, allowing script and thus remote code execution when targeting a user with script/programming right, thus compromising the confidentiality, integrity and availability of the whole XWiki installation. When a user with script right views this image and a log message `ERROR foo - Script executed!` appears in the log, the XWiki installation is vulnerable. This has been patched in XWiki 14.10.9 and 15.4RC1 by requiring a CSRF token for the actual page creation. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-wrtd-493v-3yaa
Aliases: CVE-2023-35157 GHSA-phwm-87rg-27qq |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to perform an XSS by forging a request to a delete attachment action with a specific attachment name. Now this XSS can be exploited only if the attacker knows the CSRF token of the user, or if the user ignores the warning about the missing CSRF token. The vulnerability has been patched in XWiki 15.1-rc-1 and XWiki 14.10.6. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2026-04-02T17:00:08.225602+00:00 | GHSA Importer | Affected by | VCID-3ksc-nvrc-6ub3 | https://github.com/advisories/GHSA-4f8m-7h83-9f6m | 38.1.0 |
| 2026-04-02T16:59:45.064356+00:00 | GHSA Importer | Affected by | VCID-wrtd-493v-3yaa | https://github.com/advisories/GHSA-phwm-87rg-27qq | 38.1.0 |
| 2026-04-01T12:51:43.734367+00:00 | GitLab Importer | Affected by | VCID-3ksc-nvrc-6ub3 | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.xwiki.platform/xwiki-platform-oldcore/CVE-2023-40572.yml | 38.0.0 |
| 2026-04-01T12:51:27.831122+00:00 | GitLab Importer | Affected by | VCID-wrtd-493v-3yaa | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.xwiki.platform/xwiki-platform-oldcore/CVE-2023-35157.yml | 38.0.0 |