1. Home
  2. Security Advisories
  3. Maven
  4. MAVEN:GHSA-GJMQ-X5X7-WC36

[MAVEN:GHSA-GJMQ-X5X7-WC36] XWiki Platform vulnerable to Cross-site Scripting in the deleted attachments list

Severity High
Affected Packages 2
Fixed Packages 2
CVEs 1
Info Packages References Vulnerabilities

Impact

It's possible to store a JavaScript which will be executed by anyone viewing the deleted attachments index with an attachment containing javascript in its name.

For example, attachment a file with name ><img src=1 onerror=alert(1)>.jpg will execute the alert.

Patches

This issue has been patched in XWiki 13.10.6 and 14.3.

Workarounds

It is possible to modify fix the vulnerability by editing the wiki page XWiki.DeletedAttachments with the object editor, open the JavaScriptExtension object and apply on the content the changes that can be found on the commit https://github.com/xwiki/xwiki-platform/commit/6705b0cd0289d1c90ed354bd4ecc1508c4b25745.

References

For more information

If you have any questions or comments about this advisory:
* Open an issue in Jira XWiki.org
* Email us at Security Mailing List

Package Affected Version
pkg:maven/org.xwiki.platform/xwiki-platform-index-ui >= 14.0, < 14.3
pkg:maven/org.xwiki.platform/xwiki-platform-index-ui >= 2.2-milestone-1, < 13.10.6
Package Fixed Version
pkg:maven/org.xwiki.platform/xwiki-platform-index-ui = 14.3
pkg:maven/org.xwiki.platform/xwiki-platform-index-ui = 13.10.6
ID
MAVEN:GHSA-GJMQ-X5X7-WC36
Severity
high
URL
https://github.com/advisories/GHSA-gjmq-x5x7-wc36
Published
2022-09-16T17:39:32
(2 years ago)
Modified
2023-01-27T05:03:05
(20 months ago)
Rights
Maven Security Team
Type Package URL Namespace Name / Product Version Distribution / Platform Arch Patch / Fix
Affected pkg:maven/org.xwiki.platform/xwiki-platform-index-ui org.xwiki.platform xwiki-platform-index-ui >= 14.0 < 14.3
Fixed pkg:maven/org.xwiki.platform/xwiki-platform-index-ui org.xwiki.platform xwiki-platform-index-ui = 14.3
Affected pkg:maven/org.xwiki.platform/xwiki-platform-index-ui org.xwiki.platform xwiki-platform-index-ui >= 2.2-milestone-1 < 13.10.6
Fixed pkg:maven/org.xwiki.platform/xwiki-platform-index-ui org.xwiki.platform xwiki-platform-index-ui = 13.10.6
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories Exploits PoC Pubblication Date Modification Date
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories PoC Pubblication Date Modification Date