xwiki-platform vulnerabilities
140 known vulnerabilities in xwiki-platform from XWiki. 140 are rated high or critical, and 1 has been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 9.0 Critical severity
xwiki-platform: Improper Neutralization of Input During Web Page Generation
XWiki Platform is a generic wiki platform. Starting in versions 2.2-milestone-1 and prior to versions 14.4.8, 14.10.4, and 15.0-rc-1, it's possible to execute javascript with the right of any user by leading him to a special URL on the wiki targeting a page wh
- 8.8 High severity
xwiki-platform: Incorrect Authorization
XWiki Platform is a generic wiki platform. Starting in version 3.3-milestone-2 and prior to versions 14.10.4 and 15.0-rc-1, it's possible for a user to execute anything with the right of the author of the XWiki.ClassSheet document. This has been patched in XWi
- 8.8 High severity
xwiki-platform: Improper Neutralization of Special Elements in Output Used by a Downstream Component
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions a user without script or programming right may edit a user profile (or any other document) with the wiki editor and add groovy script
- 8.8 High severity
xwiki-platform: Improper Neutralization of Special Elements in Output Used by a Downstream Component
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible to display or interact with any page a user cannot access through the combination of the async and display macros. A com
- 8.8 High severity
xwiki-platform: Improper Neutralization of Special Elements in Output Used by a Downstream Component
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Affected versions of xwiki are subject to code injection in the `since` parameter of the `/xwiki/bin/view/XWiki/Notifications/Code/LegacyNotificationAdmini
- 8.8 High severity
xwiki-platform: Improper Neutralization of Special Elements in Output Used by a Downstream Component
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to execute anything with the right of the Scheduler Application sheet page. A user without script or programming rights, edit your user profi
- 8.8 High severity
xwiki-platform: Improper Neutralization of Special Elements in Output Used by a Downstream Component
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user who can edit their own user profile can execute arbitrary script macros including Groovy and Python macros that allow remote code execution includ
- 8.8 High severity
xwiki-platform: Improper Neutralization of Special Elements in Output Used by a Downstream Component
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with view rights can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted re
- 8.8 High severity
xwiki-platform: Improper Neutralization of Special Elements in Output Used by a Downstream Component
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with view rights can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause i
- 8.8 High severity
xwiki-platform: Improper Neutralization of Special Elements in Output Used by a Downstream Component
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A registered user can perform remote code execution leading to privilege escalation by injecting the proper code in the "property" field of an attachment s
- 8.8 High severity
xwiki-platform: Improper Neutralization of Special Elements in Output Used by a Downstream Component
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with view rights can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause i
- 7.5 High severity
xwiki-platform: Exposure of Sensitive Information to an Unauthorized Actor
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The office document viewer macro was allowing anyone to see any file content from the hosting server, provided that the office server was connected and dep
- 8.8 High severity
xwiki-platform: Improper Neutralization of Special Elements in Output Used by a Downstream Component
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with view rights on `XWiki.AttachmentSelector` can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki
- 8.8 High severity
xwiki-platform: Improper Neutralization of Special Elements in Output Used by a Downstream Component
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with edit rights on any document (e.g., their own user profile) can execute code with programming rights, leading to remote code execution. This v
- 8.8 High severity
xwiki-platform: Improper Neutralization of Special Elements in Output Used by a Downstream Component
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with edit rights on a page (e.g., it's own user page), can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to th
- 8.8 High severity
xwiki-platform: Improper Neutralization of Special Elements in Output Used by a Downstream Component
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In XWiki, every user can add translations that are only applied to the current user. This also allows overriding existing translations. Such translations a
- 8.8 High severity
xwiki-platform: Cross-Site Request Forgery
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions of `org.xwiki.platform:xwiki-platform-logging-ui` it is possible to trick a user with programming rights into visiting a constructed u
- 8.8 High severity
xwiki-platform: Improper Control of Generation of Code
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with the right to add an object on a page can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki insta
- 8.8 High severity
xwiki-platform: Improper Neutralization of Directives in Dynamically Evaluated Code
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with edit rights on a page (e.g., it's own user page), can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to th
- 8.8 High severity
xwiki-platform: Improper Control of Generation of Code
XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with view rights on commonly accessible documents can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation.
- 7.2 High severity
xwiki-platform: Incorrect Use of Privileged APIs
XWiki Commons are technical libraries common to several other top level XWiki projects. The Document script API returns directly a DocumentAuthors allowing to set any authors to the document, which in consequence can allow subsequent executions of scripts sinc
- 8.8 High severity
xwiki-platform: Improper Control of Generation of Code
XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with edit rights can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escapi
- 8.8 High severity
xwiki-platform: Improper Control of Generation of Code
XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with edit rights can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escapi
- 8.8 High severity
xwiki-platform: Improper Control of Generation of Code
XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with view rights `WikiManager.DeleteWiki` can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root
- 8.8 High severity
xwiki-platform: Improper Control of Generation of Code
XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with view rights on commonly accessible documents including the notification preferences macros can execute arbitrary Groovy, Python or Velocity code in XWiki lead
- 8.8 High severity
xwiki-platform: Improper Control of Generation of Code
XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with view rights on commonly accessible documents including the legacy notification activity macro can execute arbitrary Groovy, Python or Velocity code in XWiki l
- 7.5 High severity
xwiki-platform: Exposure of Resource to Wrong Sphere
XWiki Commons are technical libraries common to several other top level XWiki projects. Rights added to a document are not taken into account for viewing it once it's deleted. Note that this vulnerability only impact deleted documents that where containing vie
- 9.0 Critical severity
xwiki-platform: Improper Neutralization of Input During Web Page Generation
XWiki Commons are technical libraries common to several other top level XWiki projects. The Livetable Macro wasn't properly sanitizing column names, thus allowing the insertion of raw HTML code including JavaScript. This vulnerability was also exploitable via
- 9.0 Critical severity
xwiki-platform: Improper Neutralization of Input During Web Page Generation
XWiki Commons are technical libraries common to several other top level XWiki projects. The RSS macro that is bundled in XWiki included the content of the feed items without any cleaning in the HTML output when the parameter `content` was set to `true`. This a
- 7.7 High severity
xwiki-platform: Improper Restriction of XML External Entity Reference
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with edit rights on a document can trigger an XAR import on a forged XAR file, leading to the ability to display the content
- 9.9 Critical severity
xwiki-platform: Improper Neutralization of Special Elements in Output Used by a Downstream Component
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with view rights can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installat
- 7.5 High severity
xwiki-platform: Improper Restriction of Excessive Authentication Attempts
XWiki Platform is a generic wiki platform. Starting in version 3.2-m3, users can deduce the content of the password fields by repeated call to `LiveTableResults` and `WikisLiveTableResultsMacros`. The issue can be fixed by upgrading to versions 14.7-rc-1, 13.4
- 8.8 High severity
xwiki-platform: Improper Privilege Management
XWiki Platform is a generic wiki platform. Starting in version 2.3-milestone-1, the annotation displayer does not execute the content in a restricted context. This allows executing anything with the right of the author of any document by annotating the documen
- 8.8 High severity
xwiki-platform: Improper Access Control
XWiki Platform is a generic wiki platform. Starting in version 13.10, it's possible to use the right of an existing document content author to execute a text area property. This has been patched in XWiki 14.10, 14.4.7, and 13.10.11. There are no known workarou
- 8.8 High severity
xwiki-platform: Improper Encoding or Escaping of Output
XWiki Platform is a generic wiki platform. Starting in version 6.2-milestone-1, one can execute any wiki content with the right of IconThemeSheet author by creating an icon theme with certain content. This can be done by creating a new page or even through the
- 8.8 High severity
xwiki-platform: Improper Access Control
XWiki Platform is a generic wiki platform. Starting in version 11.6-rc-1, comments are supposed to be executed with the right of superadmin but in restricted mode (anything dangerous is disabled), but the async macro does not take into account the restricted m
- 7.5 High severity
xwiki-platform: Out-of-bounds Write
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to make the farm unusable by adding an object to a page with a huge number (e.g. 67108863). Most of the time this will fill the memory alloca
- 8.1 High severity
xwiki-platform: Exposed Dangerous Method or Function
XWiki Platform is a generic wiki platform. Starting in version 14.3-rc-1, `org.xwiki.store.script.TemporaryAttachmentsScriptService#uploadTemporaryAttachment` returns an instance of `com.xpn.xwiki.doc.XWikiAttachment`. This class is not supported to be exposed
- 9.8 Critical severity
xwiki-platform: Improper Control of Generation of Code
XWiki Platform is a generic wiki platform. Starting in versions 6.3-rc-1 and 6.2.4, it's possible to inject arbitrary wiki syntax including Groovy, Python and Velocity script macros via the `newThemeName` request parameter (URL parameter), in combination with
- 8.8 High severity
xwiki-platform: Improper Encoding or Escaping of Output
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with view rights on commonly accessible documents including the menu macro can execute arbitrary Groovy, Python or Velocity code in XWiki leading