XWiki Platform vulnerabilities

A vulnerability in XWiki Platform versions starting with 15.10.6 and prior to 18.1.0-rc-1, 17.10.3, 17.4.9, and 16.10.17. The POST /wikis/{wikiName} API performs a XAR import without authentication or authorization checks, allowing an unauthenticated attacker to create or update documents in the target wiki.

A vulnerability in XWiki Platform allows reading configuration files by manipulating the resource parameter in ssx and jsx endpoints, leading to Path Traversal. Affects versions prior to 18.1.0-rc-1, 17.10.3, 17.4.9, and 16.10.17.

XWiki Platform is a wiki platform. Prior to versions 17.4.8 and 17.10.1, an improperly protected scripting API allows users with script right to bypass the Velocity sandbox and execute arbitrary Python scripts, leading to full access to the XWiki instance.

XWiki Platform has a vulnerability that allows remote code execution by an attacker with edit rights on the wiki. It exploits a flaw in the job scheduler and an issue with content author authorization. This vulnerability has been patched in XWiki versions 14.10.9 and 15.4RC1.

XWiki Platform is vulnerable to a CSRF attack in the create action, allowing remote code execution by users with appropriate permissions. If a user with script rights sees a specific log message, the XWiki installation is at risk.

XWiki Platform allows registered users to execute arbitrary scripts in the content field of their profile page, leading to rights escalation. This issue has been present since version 4.3M2 when support for the content field was added in the AppWithinMinutes application.

XWiki Platform has a stored XSS vulnerability that can be exploited by registered users by setting a malicious payload in the time zone user preference. Although the time zone is selected from a dropdown, it can still be set using JavaScript or the appropriate URL.

XWiki Platform allows users who can view `Invitation.WebHome` to execute arbitrary script macros, including Groovy and Python, leading to remote code execution. This vulnerability allows unrestricted read and write access to all wiki contents.

XWiki Platform has a vulnerability due to improper escaping in the `SkinsCode.XWikiSkinsSheet` document. This allows attackers to execute arbitrary script macros, including Groovy and Python, leading to remote code execution and unrestricted access to wiki content.

XWiki Platform has a vulnerability that allows remote code execution via a cross-site request forgery (CSRF) attack using the REST API. Exploitation of this flaw by a user with programming rights can impact the integrity, availability, and confidentiality of the entire XWiki installation.

XWiki Platform allows attackers to inject XWiki syntax and Velocity code by editing documents with an icon set, leading to remote code execution. Various attack vectors, including the use of the icon set in HTML, can be exploited.

XWiki Platform allows users to edit their profiles and notification settings, enabling the execution of arbitrary script macros, including Groovy and Python, leading to remote code execution. Versions 14.10.6 and 15.2RC1 contain patches for this vulnerability.

A vulnerability in XWiki Platform allows remote code execution even after upgrading to a version that includes fixes. The issue arises when old document versions containing vulnerabilities are not removed from history, allowing for their reuse.

XWiki Platform has a vulnerability allowing for XSS attacks by injecting JavaScript through a forged URL. This can be exploited using the previewactions template, potentially executing unauthorized code on the page.

XWiki Platform allows users to forge URLs with payloads, enabling JavaScript injection on the page (XSS). The DeleteApplication page can be exploited to perform an XSS attack using a specially crafted URL.

XWiki Platform has a vulnerability to XSS attacks, allowing users to inject JavaScript code through forged URLs. Exploiting the resubmit template enables the execution of malicious code, potentially leading to user data exposure.

XWiki Platform allows users to forge URLs with payloads that enable JavaScript injection on the page (XSS). The deletespace template can be exploited to perform an XSS attack, for example using the URL: > xwiki/bin/deletespace/Sandbox/?xredirect=javascript:alert(document.domain).

The XWiki Platform has a vulnerability that allows the injection of JavaScript (XSS) through a forged URL. Users can exploit the restore template to perform an XSS attack, potentially leading to unauthorized access to data.

XWiki Platform has a vulnerability to XSS attacks, allowing users to inject JavaScript through a forged URL. Exploiting the delete template enables XSS attacks, which may lead to unauthorized access to user data.

XWiki Platform has a stored cross-site scripting (XSS) vulnerability that can be exploited by users with edit rights. Versions from 5.4.4 up to but not including 14.4.8, 14.10.4, and 15.0 are affected.

XWiki Platform, from version 12.9-rc-1 to 14.4.8, 14.10.6, and 15.1, allows logged-in users to add dangerous content in the first name field, leading to rights escalation. The vulnerability has been fixed in versions 14.4.8, 14.10.6, and 15.1.

XWiki Platform, a popular wiki platform, has a vulnerability that allows users with view rights on documents to execute code with programming rights. Versions from 2.40m-2 up to but not including 14.4.8, 14.10.4, and 15.0 are susceptible to remote code execution via a specially crafted URL.

In XWiki Platform, from version 11.8-rc-1 to 14.4.8, 14.10.6, and 15.2, any logged-in user can edit the `Mail.MailConfig` configuration. This allows them to change the mail obfuscation settings and view and edit mail sending configurations, including the SMTP domain name and credentials.

XWiki Platform versions from 2.2.1 to 14.4.8, 14.10.5, and 15.1RC1 are vulnerable to a stored cross-site scripting (XSS) attack. Users can insert HTML code into documents, allowing unauthorized actions to be performed by other users who visit those documents.

XWiki Platform is a generic wiki platform that allows executing any wiki content with the rights of the TipsPanel author by creating a tip UI extension. This issue has been patched in XWiki versions 15.1-rc-1 and 14.10.5.

XWiki Platform has a vulnerability that allows discovering user password hashes bit by bit via modified LiveTableResults parameters, even after a previous patch.

In XWiki Platform, it is possible to execute Velocity code without having script rights by creating an XClass with a property of type 'TextArea' and content type 'VelocityCode' or 'VelocityWiki'. In both cases, the code is executed regardless of the rights of the property author, which may lead to unauthorized access to data and APIs.

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It is possible to perform an XSS by forging a request to a delete attachment action with a specific attachment name.

XWiki Platform has a XSS vulnerability that allows users to inject JavaScript through forged URLs. An example URL can execute an `alert` command in the browser, potentially leading to unauthorized access to user data.

XWiki Platform, from version 7.3-milestone-1 to versions 14.4.8, 14.10.6, and 15.1, allows access to obfuscated passwords via REST API, even when email obfuscation is enabled. The issue has been patched in versions 14.4.8, 14.10.6, and 15.1.

XWiki Platform has a vulnerability related to email obfuscation configuration. In versions from 3.5-milestone-1 to 14.4.8, 14.10.4, and 15.0-rc-1, server responses contained unobfuscated email addresses, allowing users to read them.

The XWiki Platform has a vulnerability that allows tags from pages not viewable to the current user to be leaked via the tags API. This information can be exploited to infer the document reference of non-viewable pages.