Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:maven/org.xwiki.platform/xwiki-platform-web@7.2-milestone-2
Typemaven
Namespaceorg.xwiki.platform
Namexwiki-platform-web
Version7.2-milestone-2
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version12.8
Latest_non_vulnerable_version17.9.0
Affected_by_vulnerabilities
0
url VCID-8e5e-91ey-tybx
vulnerability_id VCID-8e5e-91ey-tybx
summary 
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In `org.xwiki.platform:xwiki-platform-web` versions 7.2-milestone-2 until 14.10.12 and `org.xwiki.platform:xwiki-platform-web-templates` prior to versions 14.10.12 and 15.5-rc-1, it is possible to pass a title to the page creation action that isn't displayed at first but then executed in the second step. This can be used by an attacker to trick a victim to execute code, allowing script execution if the victim has script right or remote code execution including full access to the XWiki instance if the victim has programming right.
references
0
reference_url https://github.com/xwiki/xwiki-platform/commit/199e27ce7016757e66fa7cea99e718044a1b639b
reference_id
reference_type
scores
url https://github.com/xwiki/xwiki-platform/commit/199e27ce7016757e66fa7cea99e718044a1b639b
1
reference_url https://jira.xwiki.org/browse/XWIKI-20869
reference_id
reference_type
scores
url https://jira.xwiki.org/browse/XWIKI-20869
2
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-45135
reference_id CVE-2023-45135
reference_type
scores
url https://nvd.nist.gov/vuln/detail/CVE-2023-45135
3
reference_url https://github.com/advisories/GHSA-ghf6-2f42-mjh9
reference_id GHSA-ghf6-2f42-mjh9
reference_type
scores
url https://github.com/advisories/GHSA-ghf6-2f42-mjh9
4
reference_url https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-ghf6-2f42-mjh9
reference_id GHSA-ghf6-2f42-mjh9
reference_type
scores
url https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-ghf6-2f42-mjh9
fixed_packages
0
url pkg:maven/org.xwiki.platform/xwiki-platform-web@14.10.12
purl pkg:maven/org.xwiki.platform/xwiki-platform-web@14.10.12
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.xwiki.platform/xwiki-platform-web@14.10.12
aliases CVE-2023-45135, GHSA-ghf6-2f42-mjh9
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-8e5e-91ey-tybx
Fixing_vulnerabilities
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:maven/org.xwiki.platform/xwiki-platform-web@7.2-milestone-2