1. Home
  2. Security Advisories
  3. Maven
  4. MAVEN:GHSA-Q6JP-GCWW-8V2J

[MAVEN:GHSA-Q6JP-GCWW-8V2J] Missing Authorization in Filter Stream Converter Application of XWiki-platform

Severity Critical
Affected Packages 3
Fixed Packages 3
CVEs 1
Info Packages References Vulnerabilities

Impact

The application allow anyone with view access to modify any page of the wiki by importing a crafted XAR package.

Patches

The problem has been patched in XWiki 14.6RC1, 14.6 and 13.10.8.

Workarounds

The problem can be patched immediately by setting the right of the page Filter.WebHome and making sure only main wiki administrators can VIEW it the application is installed on main wiki or edit the page and apply the changed described on https://github.com/xwiki/xwiki-platform/commit/fb49b4f289ee28e45cfada8e97e320cd3ed27113.

References

For more information

If you have any questions or comments about this advisory:
* Open an issue in JIRA
* Email us at security ML

Package Affected Version
pkg:maven/org.xwiki.platform/xwiki-platform-filter-ui >= 14.5.0, < 14.6-rc-1
pkg:maven/org.xwiki.platform/xwiki-platform-filter-ui >= 14.0.0, < 14.4.3
pkg:maven/org.xwiki.platform/xwiki-platform-filter-ui < 13.10.8
Package Fixed Version
pkg:maven/org.xwiki.platform/xwiki-platform-filter-ui = 14.6-rc-1
pkg:maven/org.xwiki.platform/xwiki-platform-filter-ui = 14.4.3
pkg:maven/org.xwiki.platform/xwiki-platform-filter-ui = 13.10.8
ID
MAVEN:GHSA-Q6JP-GCWW-8V2J
Severity
critical
URL
https://github.com/advisories/GHSA-q6jp-gcww-8v2j
Published
2022-11-21T23:46:47
(22 months ago)
Modified
2023-01-31T05:07:35
(19 months ago)
Rights
Maven Security Team
Type Package URL Namespace Name / Product Version Distribution / Platform Arch Patch / Fix
Affected pkg:maven/org.xwiki.platform/xwiki-platform-filter-ui org.xwiki.platform xwiki-platform-filter-ui >= 14.5.0 < 14.6-rc-1
Fixed pkg:maven/org.xwiki.platform/xwiki-platform-filter-ui org.xwiki.platform xwiki-platform-filter-ui = 14.6-rc-1
Affected pkg:maven/org.xwiki.platform/xwiki-platform-filter-ui org.xwiki.platform xwiki-platform-filter-ui >= 14.0.0 < 14.4.3
Fixed pkg:maven/org.xwiki.platform/xwiki-platform-filter-ui org.xwiki.platform xwiki-platform-filter-ui = 14.4.3
Affected pkg:maven/org.xwiki.platform/xwiki-platform-filter-ui org.xwiki.platform xwiki-platform-filter-ui < 13.10.8
Fixed pkg:maven/org.xwiki.platform/xwiki-platform-filter-ui org.xwiki.platform xwiki-platform-filter-ui = 13.10.8
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories Exploits PoC Pubblication Date Modification Date
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories PoC Pubblication Date Modification Date