org.xwiki.platform:xwiki-platform-security-authentication-default XSS with authenticated endpoints (xwiki xwiki-platform)
At a glance
- Source
- NVD
- EPSS
- EPSS 1.72 % · percentile 77 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- GitHub_M
- NVD status
- Modified
Description
XWiki Commons are technical libraries common to several other top level XWiki projects. It was possible to inject some code using the URL of authenticated endpoints. This problem has been patched on XWiki 13.10.11, 14.4.7 and 14.10.
Weaknesses (CWE)
- CWE-79 — Improper Neutralization of Input During Web Page Generation
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.4 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N | GitHub_M |
| CVSS 3.1 | MEDIUM 5.4 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N | NVD · security-advisories@github.com (Secondary) |
| CVSS 3.1 | MEDIUM 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-jjm5-5v9v-7hx2 — org.xwiki.platform:xwiki-platform-security-authentication-default XSS with authenticate endpoints
European references
- ENISA EUVD · EUVD-2023-1341
- GCVE · GCVE-0-2023-29506
Affected configurations (NVD CPE)
cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*≥ 13.10.8 < 13.10.11cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*≥ 14.4.3 < 14.4.7cpe:2.3:a:xwiki:xwiki:14.6:*:*:*:*:*:*:*cpe:2.3:a:xwiki:xwiki:14.10:rc1:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| xwiki · xwiki-platform | affected >= 13.10.8, < 13.10.11 ; affected >= 14.4.3, < 14.4.7 ; affected >= 14.6, < 14.10 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |