Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:maven/org.xwiki.platform/xwiki-platform-annotation-ui@14.4.7
Typemaven
Namespaceorg.xwiki.platform
Namexwiki-platform-annotation-ui
Version14.4.7
Qualifiers
Subpath
Is_vulnerablefalse
Next_non_vulnerable_version14.10
Latest_non_vulnerable_version14.10
Affected_by_vulnerabilities
Fixing_vulnerabilities
0
url VCID-9mzp-jd8p-rfgz
vulnerability_id VCID-9mzp-jd8p-rfgz
summary 
xwiki-platform vulnerable to Remote Code Execution in Annotations
XWiki Platform is a generic wiki platform. Starting in version 2.3-milestone-1, the annotation displayer does not execute the content in a restricted context. This allows executing anything with the right of the author of any document by annotating the document. This has been patched in XWiki 13.10.11, 14.4.7 and 14.10. There is no easy workaround except to upgrade.
references
0
reference_url https://github.com/xwiki/xwiki-platform/commit/d87d7bfd8db18c20d3264f98c6deefeae93b99f7
reference_id
reference_type
scores
url https://github.com/xwiki/xwiki-platform/commit/d87d7bfd8db18c20d3264f98c6deefeae93b99f7
1
reference_url https://jira.xwiki.org/browse/XWIKI-20360
reference_id
reference_type
scores
url https://jira.xwiki.org/browse/XWIKI-20360
2
reference_url https://jira.xwiki.org/browse/XWIKI-20384
reference_id
reference_type
scores
url https://jira.xwiki.org/browse/XWIKI-20384
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-26475
reference_id CVE-2023-26475
reference_type
scores
url https://nvd.nist.gov/vuln/detail/CVE-2023-26475
4
reference_url https://github.com/advisories/GHSA-h6f5-8jj5-cxhr
reference_id GHSA-h6f5-8jj5-cxhr
reference_type
scores
url https://github.com/advisories/GHSA-h6f5-8jj5-cxhr
5
reference_url https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-h6f5-8jj5-cxhr
reference_id GHSA-h6f5-8jj5-cxhr
reference_type
scores
url https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-h6f5-8jj5-cxhr
fixed_packages
0
url pkg:maven/org.xwiki.platform/xwiki-platform-annotation-ui@13.10.11
purl pkg:maven/org.xwiki.platform/xwiki-platform-annotation-ui@13.10.11
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.xwiki.platform/xwiki-platform-annotation-ui@13.10.11
1
url pkg:maven/org.xwiki.platform/xwiki-platform-annotation-ui@14.4.7
purl pkg:maven/org.xwiki.platform/xwiki-platform-annotation-ui@14.4.7
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.xwiki.platform/xwiki-platform-annotation-ui@14.4.7
2
url pkg:maven/org.xwiki.platform/xwiki-platform-annotation-ui@14.10
purl pkg:maven/org.xwiki.platform/xwiki-platform-annotation-ui@14.10
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.xwiki.platform/xwiki-platform-annotation-ui@14.10
aliases CVE-2023-26475, GHSA-h6f5-8jj5-cxhr
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-9mzp-jd8p-rfgz
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:maven/org.xwiki.platform/xwiki-platform-annotation-ui@14.4.7