xwiki xwiki 14.4.4 vulnerabilities and exploits

(subscribe to this query)

8.2

CVSSv3

org.xwiki.platform:xwiki-platform-user-profile-ui is missing authorization to enable or disable users. Any user (logged in or not) with access to the page XWiki.XWikiUserProfileSheet can enable or disable any user profile. This might allow to a disabled user to re-enable themselv...

Xwiki Xwiki Xwiki Xwiki 14.4.3 Xwiki Xwiki 14.4.4

5.3

CVSSv3

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to make XWiki create many new schemas and fill them with tables just by using a crafted user identifier in the login form. This may lead to degraded databas...

Xwiki Xwiki Xwiki Xwiki 14.4.3 Xwiki Xwiki 14.4.4

8.8

CVSSv3

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with view rights on commonly accessible documents including the menu macro can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to th...

Xwiki Xwiki Xwiki Xwiki 14.4.4 Xwiki Xwiki 14.4.5

4.3

CVSSv3

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users without the right to view documents can deduce their existence by repeated Livetable queries. The issue has been patched in XWiki 14.6RC1, 13.10.8, and 14.4.3, the respo...

Xwiki Xwiki Xwiki Xwiki 14.4.4 Xwiki Xwiki 14.4.5

8.8

CVSSv3

XWiki Platform vulnerable to Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in AttachmentSelector.xml. The issue can also be reproduced by inserting the dangerous payload in the `height` or `alt` macro properties. This has been pa...

Xwiki Xwiki Xwiki Xwiki 5.0 Xwiki Xwiki 14.4.3 Xwiki Xwiki 14.4.4

4.9

CVSSv3

org.xwiki.platform:xwiki-platform-oldcore is missing authorization in User#setDisabledStatus, which may allow an incorrectly authorized user with only Script rights to enable or disable a user. This operation is meant to only be available for users with admin rights. This problem...

Xwiki Xwiki Xwiki Xwiki 11.7 Xwiki Xwiki 14.4.3 Xwiki Xwiki 14.4.4

8.8

CVSSv3

xwiki-platform-icon-ui is vulnerable to Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection'). Any user with view rights on commonly accessible documents including the icon picker macro can execute arbitrary Groovy, Python or Velocity co...

Xwiki Xwiki 6.4 Xwiki Xwiki Xwiki Xwiki 14.4.3 Xwiki Xwiki 14.4.4

6.1

CVSSv3

XWiki Commons are technical libraries common to several other top level XWiki projects. It is possible to bypass the existing security measures put in place to avoid open redirect by using a redirect such as `//mydomain.com` (i.e. omitting the `http:`). It was also possible to by...

Xwiki Xwiki Xwiki Xwiki 6.0

9.9

CVSSv3

XWiki Commons are technical libraries common to several other top level XWiki projects. Starting in version 3.1-milestone-1, any user can edit their own profile and inject code, which is going to be executed with programming right. The same vulnerability can also be exploited in ...

Xwiki Commons 3.1 Xwiki Commons 3.1.1 Xwiki Commons Xwiki Commons 14.4

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook