Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:maven/org.xwiki.platform/xwiki-platform-invitation-ui@2.4-m-2
Typemaven
Namespaceorg.xwiki.platform
Namexwiki-platform-invitation-ui
Version2.4-m-2
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version13.10.11
Latest_non_vulnerable_version15.2-rc-1
Affected_by_vulnerabilities
0
url VCID-uvpn-b7fv-eyd7
vulnerability_id VCID-uvpn-b7fv-eyd7
summary 
Improper Control of Generation of Code ('Code Injection')
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 2.40m-2 and prior to versions 14.4.8, 14.10.4, and 15.0, any user with view rights on any document can execute code with programming rights, leading to remote code execution by crafting an url with a dangerous payload. The problem has been patched in XWiki 15.0, 14.10.4 and 14.4.8.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-35150
reference_id
reference_type
scores
0
value 0.34627
scoring_system epss
scoring_elements 0.97099
published_at 2026-06-05T12:55:00Z
1
value 0.34627
scoring_system epss
scoring_elements 0.971
published_at 2026-06-06T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-35150
1
reference_url https://github.com/xwiki/xwiki-platform
reference_id
reference_type
scores
0
value 9.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/xwiki/xwiki-platform
2
reference_url https://github.com/xwiki/xwiki-platform/commit/b65220a4d86b8888791c3b643074ebca5c089a3a
reference_id
reference_type
scores
0
value 9.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
1
value CRITICAL
scoring_system generic_textual
scoring_elements
2
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2024-11-29T14:35:08Z/
url https://github.com/xwiki/xwiki-platform/commit/b65220a4d86b8888791c3b643074ebca5c089a3a
3
reference_url https://jira.xwiki.org/browse/XWIKI-20285
reference_id
reference_type
scores
0
value 9.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
1
value CRITICAL
scoring_system generic_textual
scoring_elements
2
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2024-11-29T14:35:08Z/
url https://jira.xwiki.org/browse/XWIKI-20285
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-35150
reference_id CVE-2023-35150
reference_type
scores
0
value 9.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-35150
5
reference_url https://github.com/advisories/GHSA-6mf5-36v9-3h2w
reference_id GHSA-6mf5-36v9-3h2w
reference_type
scores
url https://github.com/advisories/GHSA-6mf5-36v9-3h2w
6
reference_url https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-6mf5-36v9-3h2w
reference_id GHSA-6mf5-36v9-3h2w
reference_type
scores
0
value 9.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
1
value CRITICAL
scoring_system generic_textual
scoring_elements
2
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2024-11-29T14:35:08Z/
url https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-6mf5-36v9-3h2w
fixed_packages
0
url pkg:maven/org.xwiki.platform/xwiki-platform-invitation-ui@14.4.8
purl pkg:maven/org.xwiki.platform/xwiki-platform-invitation-ui@14.4.8
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.xwiki.platform/xwiki-platform-invitation-ui@14.4.8
1
url pkg:maven/org.xwiki.platform/xwiki-platform-invitation-ui@14.10.4
purl pkg:maven/org.xwiki.platform/xwiki-platform-invitation-ui@14.10.4
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.xwiki.platform/xwiki-platform-invitation-ui@14.10.4
2
url pkg:maven/org.xwiki.platform/xwiki-platform-invitation-ui@15.0
purl pkg:maven/org.xwiki.platform/xwiki-platform-invitation-ui@15.0
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.xwiki.platform/xwiki-platform-invitation-ui@15.0
aliases CVE-2023-35150, GHSA-6mf5-36v9-3h2w
risk_score 4.5
exploitability 0.5
weighted_severity 9.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-uvpn-b7fv-eyd7
Fixing_vulnerabilities
Risk_score4.5
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:maven/org.xwiki.platform/xwiki-platform-invitation-ui@2.4-m-2