org.xwiki.platform:xwiki-platform-oldcore (Maven)
Advisories
109
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 18.2.0 or later clears every advisory below that has a fix.
Upgrade commands
maven
<dependency><groupId>org.xwiki.platform</groupId><artifactId>xwiki-platform-oldcore</artifactId><version>18.2.0</version></dependency>gradle
implementation("org.xwiki.platform:xwiki-platform-oldcore:18.2.0")Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-qj4x-9g63-25g6 XWiki Platform Old Core: Resource path traversal via /skin/ action endpoint in Jetty 12+ |
High EPSS 2.47% |
>= 18.0.0-rc-1, < 18.2.0 | 18.2.0 |
| GHSA-qj4x-9g63-25g6 XWiki Platform Old Core: Resource path traversal via /skin/ action endpoint in Jetty 12+ |
High EPSS 2.47% |
< 17.10.5 | 17.10.5 |
| GHSA-mrqg-xmgm-rc5g XWiki's REST APIs can list all pages/spaces, leading to unavailability |
High EPSS 0.40% |
>= 17.0.0-rc-1, < 17.4.8 | 17.4.8 |
| GHSA-mrqg-xmgm-rc5g XWiki's REST APIs can list all pages/spaces, leading to unavailability |
High EPSS 0.40% |
>= 17.5.0-rc-1, < 17.10.1 | 17.10.1 |
| GHSA-mrqg-xmgm-rc5g XWiki's REST APIs can list all pages/spaces, leading to unavailability |
High EPSS 0.40% |
>= 1.8-rc-1, < 16.10.16 | 16.10.16 |
| GHSA-h259-74h5-4rh9 XWiki vulnerable to remote code execution with script right through unprotected Velocity scripting API |
Critical EPSS 0.54% |
>= 17.5.0-rc-1, < 17.10.1 | 17.10.1 |
| GHSA-h259-74h5-4rh9 XWiki vulnerable to remote code execution with script right through unprotected Velocity scripting API |
Critical EPSS 0.54% |
>= 17.0.0-rc-1, < 17.4.8 | 17.4.8 |
| GHSA-57q2-6cp4-9mq3 XWiki exposes passwords and emails stored in fields not named password/email in xml.vm |
Medium EPSS 1.45% |
>= 1.1, < 16.4.7 | 16.4.7 |
| GHSA-57q2-6cp4-9mq3 XWiki exposes passwords and emails stored in fields not named password/email in xml.vm |
Medium EPSS 1.45% |
>= 17.0.0-rc-1, < 17.2.0-rc-1 | 17.2.0-rc-1 |
| GHSA-57q2-6cp4-9mq3 XWiki exposes passwords and emails stored in fields not named password/email in xml.vm |
Medium EPSS 1.45% |
>= 16.5.0-rc-1, < 16.10.5 | 16.10.5 |
| GHSA-r38m-cgpg-qj69 XWiki leaks password hashes and other accessible password properties |
Medium EPSS 0.48% |
>= 16.5.0-rc-1, < 16.10.5 | 16.10.5 |
| GHSA-r38m-cgpg-qj69 XWiki leaks password hashes and other accessible password properties |
Medium EPSS 0.48% |
>= 9.8-rc-1, < 16.4.7 | 16.4.7 |
| GHSA-r38m-cgpg-qj69 XWiki leaks password hashes and other accessible password properties |
Medium EPSS 0.48% |
>= 17.0.0-rc-1, < 17.2.0-rc-1 | 17.2.0-rc-1 |
| GHSA-p9qm-p942-q3w5 XWiki Platform vulnerable to SQL injection through XWiki#searchDocuments API |
Critical EPSS 0.68% |
>= 17.0.0-rc1, < 17.3.0-rc-1 | 17.3.0-rc-1 |
| GHSA-p9qm-p942-q3w5 XWiki Platform vulnerable to SQL injection through XWiki#searchDocuments API |
Critical EPSS 0.68% |
>= 1.0, < 16.10.6 | 16.10.6 |
| GHSA-jp4x-w9cj-97q7 XWiki allows remote code execution through preview of XClass changes in AWM editor |
High EPSS 0.75% |
>= 7.2-milestone-2, < 16.4.7 | 16.4.7 |
| GHSA-jp4x-w9cj-97q7 XWiki allows remote code execution through preview of XClass changes in AWM editor |
High EPSS 0.75% |
>= 17.0.0-rc-1, < 17.0.0 | 17.0.0 |
| GHSA-jp4x-w9cj-97q7 XWiki allows remote code execution through preview of XClass changes in AWM editor |
High EPSS 0.75% |
>= 16.5.0-rc-1, < 16.10.3 | 16.10.3 |
| GHSA-prwh-7838-xf82 XWiki allows SQL injection in query endpoint of REST API with Oracle |
Critical EPSS 0.51% |
>= 16.0.0-rc-1, < 16.4.7 | 16.4.7 |
| GHSA-prwh-7838-xf82 XWiki allows SQL injection in query endpoint of REST API with Oracle |
Critical EPSS 0.51% |
>= 1.0, < 15.10.16 | 15.10.16 |
| GHSA-prwh-7838-xf82 XWiki allows SQL injection in query endpoint of REST API with Oracle |
Critical EPSS 0.51% |
>= 16.5.0-rc-1, < 16.10.2 | 16.10.2 |
| GHSA-g9jj-75mx-wjcx org.xwiki.platform:xwiki-platform-oldcore allows SQL injection in short form select requests through the script query API |
High EPSS 0.59% |
>= 16.5.0-rc-1, < 16.10.1 | 16.10.1 |
| GHSA-g9jj-75mx-wjcx org.xwiki.platform:xwiki-platform-oldcore allows SQL injection in short form select requests through the script query API |
High EPSS 0.59% |
>= 16.0.0-rc-1, < 16.4.6 | 16.4.6 |
| GHSA-g9jj-75mx-wjcx org.xwiki.platform:xwiki-platform-oldcore allows SQL injection in short form select requests through the script query API |
High EPSS 0.59% |
>= 1.6-milestone-1, < 15.10.16 | 15.10.16 |
| GHSA-wcg9-pgqv-xm5v XWiki Platform allows XSS through XClass name in string properties |
Medium EPSS 0.49% |
>= 16.0.0-rc-1, < 16.0.0 | 16.0.0 |
| GHSA-wcg9-pgqv-xm5v XWiki Platform allows XSS through XClass name in string properties |
Medium EPSS 0.49% |
>= 15.6-rc-1, < 15.10.6 | 15.10.6 |
| GHSA-wcg9-pgqv-xm5v XWiki Platform allows XSS through XClass name in string properties |
Medium EPSS 0.49% |
>= 15.0-rc-1, < 15.5.5 | 15.5.5 |
| GHSA-wcg9-pgqv-xm5v XWiki Platform allows XSS through XClass name in string properties |
Medium EPSS 0.49% |
>= 1.1.2, < 14.10.21 | 14.10.21 |
| GHSA-33gp-gmg3-hfpq XWiki Platform vulnerable to document deletion and overwrite from edit |
Medium EPSS 0.40% |
>= 15.6-rc-1, < 15.10.6 | 15.10.6 |
| GHSA-33gp-gmg3-hfpq XWiki Platform vulnerable to document deletion and overwrite from edit |
Medium EPSS 0.40% |
>= 15.0, < 15.5.5 | 15.5.5 |
| GHSA-33gp-gmg3-hfpq XWiki Platform vulnerable to document deletion and overwrite from edit |
Medium EPSS 0.40% |
>= 14.2, < 14.10.21 | 14.10.21 |
| GHSA-33gp-gmg3-hfpq XWiki Platform vulnerable to document deletion and overwrite from edit |
Medium EPSS 0.40% |
>= 13.10.4, < 14.10.21 | 14.10.21 |
| GHSA-j584-j2vj-3f93 XWiki Platform allows remote code execution from user account |
High EPSS 0.69% |
>= 16.0.0-rc-1, < 16.0.0 | 16.0.0 |
| GHSA-j584-j2vj-3f93 XWiki Platform allows remote code execution from user account |
High EPSS 0.69% |
>= 15.6-rc-1, < 15.10.6 | 15.10.6 |
| GHSA-j584-j2vj-3f93 XWiki Platform allows remote code execution from user account |
High EPSS 0.69% |
>= 15.0-rc-1, < 15.5.5 | 15.5.5 |
| GHSA-j584-j2vj-3f93 XWiki Platform allows remote code execution from user account |
High EPSS 0.69% |
>= 13.10.3, < 14.10.21 | 14.10.21 |
| GHSA-j584-j2vj-3f93 XWiki Platform allows remote code execution from user account |
High EPSS 0.69% |
>= 13.4.7, < 14.10.21 | 14.10.21 |
| GHSA-cv55-v6rw-7r5v XWiki Platform remote code execution from account via custom skins support |
High EPSS 1.45% |
>= 15.0-rc-1, < 15.5.4 | 15.5.4 |
| GHSA-cv55-v6rw-7r5v XWiki Platform remote code execution from account via custom skins support |
High EPSS 1.45% |
>= 15.6-rc-1, < 15.10-rc-1 | 15.10-rc-1 |
| GHSA-cv55-v6rw-7r5v XWiki Platform remote code execution from account via custom skins support |
High EPSS 1.45% |
>= 6.4-milestone-1, < 14.10.19 | 14.10.19 |
| GHSA-vxwr-wpjv-qjq7 XWiki Platform: Privilege escalation (PR) from user registration through PDFClass |
High EPSS 1.45% |
>= 15.0-rc-1, < 15.5.4 | 15.5.4 |
| GHSA-vxwr-wpjv-qjq7 XWiki Platform: Privilege escalation (PR) from user registration through PDFClass |
High EPSS 1.45% |
>= 15.6-rc-1, < 15.10-rc-1 | 15.10-rc-1 |
| GHSA-vxwr-wpjv-qjq7 XWiki Platform: Privilege escalation (PR) from user registration through PDFClass |
High EPSS 1.45% |
>= 3.0.1, < 14.10.20 | 14.10.20 |
| GHSA-v782-xr4w-3vqx XWiki Platform: Password hash might be leaked by diff once the xobject holding them is deleted |
Medium EPSS 0.38% |
>= 15.6-rc-1, < 15.9-rc-1 | 15.9-rc-1 |
| GHSA-v782-xr4w-3vqx XWiki Platform: Password hash might be leaked by diff once the xobject holding them is deleted |
Medium EPSS 0.38% |
>= 15.0-rc-1, < 15.5.4 | 15.5.4 |
| GHSA-v782-xr4w-3vqx XWiki Platform: Password hash might be leaked by diff once the xobject holding them is deleted |
Medium EPSS 0.38% |
>= 5.0-rc-1, < 14.10.19 | 14.10.19 |
| GHSA-xh35-w7wg-95v3 XWiki has no right protection on rollback action |
High EPSS 0.51% |
>= 1.0, < 14.10.17 | 14.10.17 |
| GHSA-g2qq-c5j9-5w5w XWiki Platform vulnerable to privilege escalation and remote code execution via the edit action |
High EPSS 0.98% |
>= 1.0, < 14.10.6 | 14.10.6 |
| GHSA-g2qq-c5j9-5w5w XWiki Platform vulnerable to privilege escalation and remote code execution via the edit action |
High EPSS 0.98% |
>= 15.0, < 15.2-rc-1 | 15.2-rc-1 |
| GHSA-hgpw-6p4h-j6h5 XWiki Platform vulnerable to remote code execution via the edit action because it lacks CSRF token |
High EPSS 0.38% |
>= 1.0, < 14.10.7 | 14.10.7 |
| GHSA-hgpw-6p4h-j6h5 XWiki Platform vulnerable to remote code execution via the edit action because it lacks CSRF token |
High EPSS 0.38% |
>= 15.0, < 15.2-rc-1 | 15.2-rc-1 |
| GHSA-gh64-qxh5-4m33 org.xwiki.platform:xwiki-platform-oldcore may leak data through deleted and re-created documents |
Medium EPSS 0.94% |
>= 9.4-rc-1, < 14.10.8 | 14.10.8 |
| GHSA-gh64-qxh5-4m33 org.xwiki.platform:xwiki-platform-oldcore may leak data through deleted and re-created documents |
Medium EPSS 0.94% |
>= 15.0-rc-1, < 15.3-rc-1 | 15.3-rc-1 |
| GHSA-m5m2-h6h9-p2c8 Velocity execution without script right through VelocityCode and VelocityWiki property |
Medium EPSS 0.55% |
>= 7.2, < 14.10.10 | 14.10.10 |
| GHSA-m5m2-h6h9-p2c8 Velocity execution without script right through VelocityCode and VelocityWiki property |
Medium EPSS 0.55% |
>= 15.0-rc-1, < 15.4-rc-1 | 15.4-rc-1 |
| GHSA-4f8m-7h83-9f6m XWiki Platform vulnerable to CSRF privilege escalation/RCE via the create action |
High EPSS 0.62% |
>= 15.0-rc-1, < 15.4-rc-1 | 15.4-rc-1 |
| GHSA-4f8m-7h83-9f6m XWiki Platform vulnerable to CSRF privilege escalation/RCE via the create action |
High EPSS 0.62% |
>= 3.2-milestone-3, < 14.10.9 | 14.10.9 |
| GHSA-8q9q-r9v2-644m Upgrading doesn't prevent exploiting vulnerable XWiki documents |
High EPSS 1.86% |
>= 15.0-rc-1, < 15.2-rc-1 | 15.2-rc-1 |
| GHSA-8q9q-r9v2-644m Upgrading doesn't prevent exploiting vulnerable XWiki documents |
High EPSS 1.86% |
>= 2.0, < 14.10.7 | 14.10.7 |
| GHSA-phwm-87rg-27qq XWiki Platform vulnerable to reflected cross-site scripting via delattachment action |
Medium EPSS 0.63% |
>= 3.2-milestone-3, < 14.10.6 | 14.10.6 |
| GHSA-phwm-87rg-27qq XWiki Platform vulnerable to reflected cross-site scripting via delattachment action |
Medium EPSS 0.63% |
>= 15.0-rc-0, < 15.1-rc-1 | 15.1-rc-1 |
| GHSA-6gvj-8vc5-8v3j org.xwiki.platform:xwiki-platform-oldcore Open Redirect vulnerability |
Medium EPSS 55.07% |
< 14.10.4 | 14.10.4 |
| GHSA-gpq5-7p34-vqx5 XWiki Platform's async and display macro allow displaying and interacting with any document in restricted mode |
High EPSS 1.14% |
>= 10.11.1, < 13.10.11 | 13.10.11 |
| GHSA-gpq5-7p34-vqx5 XWiki Platform's async and display macro allow displaying and interacting with any document in restricted mode |
High EPSS 1.14% |
>= 14.0-rc-1, < 14.4.8 | 14.4.8 |
| GHSA-gpq5-7p34-vqx5 XWiki Platform's async and display macro allow displaying and interacting with any document in restricted mode |
High EPSS 1.14% |
>= 14.5, < 14.10.3 | 14.10.3 |
| GHSA-x764-ff8r-9hpx XWiki Platform vulnerable to code injection in display method used in user profiles |
High EPSS 2.00% |
>= 3.3-milestone-1, < 13.10.11 | 13.10.11 |
| GHSA-x764-ff8r-9hpx XWiki Platform vulnerable to code injection in display method used in user profiles |
High EPSS 2.00% |
>= 14.0-rc-1, < 14.4.8 | 14.4.8 |
| GHSA-x764-ff8r-9hpx XWiki Platform vulnerable to code injection in display method used in user profiles |
High EPSS 2.00% |
>= 14.5, < 14.10.2 | 14.10.2 |
| GHSA-xwph-x6xj-wggv org.xwiki.platform:xwiki-platform-oldcore Open Redirect vulnerability |
Medium EPSS 1.76% |
>= 14.0-rc-1, < 14.4.4 | 14.4.4 |
| GHSA-xwph-x6xj-wggv org.xwiki.platform:xwiki-platform-oldcore Open Redirect vulnerability |
Medium EPSS 1.76% |
>= 14.5, < 14.8-rc-1 | 14.8-rc-1 |
| GHSA-xwph-x6xj-wggv org.xwiki.platform:xwiki-platform-oldcore Open Redirect vulnerability |
Medium EPSS 1.76% |
>= 6.0-rc-1, < 13.10.10 | 13.10.10 |
| GHSA-pwfv-3cvg-9m4c org.xwiki.platform:xwiki-platform-oldcore makes Incorrect Use of Privileged APIs with DocumentAuthors |
High EPSS 0.90% |
>= 14.4.1, < 14.4.7 | 14.4.7 |
| GHSA-pwfv-3cvg-9m4c org.xwiki.platform:xwiki-platform-oldcore makes Incorrect Use of Privileged APIs with DocumentAuthors |
High EPSS 0.90% |
>= 14.5, < 14.10 | 14.10 |
| GHSA-4f8g-fq6x-jqrr org.xwiki.platform:xwiki-platform-oldcore vulnerable to data leak through deleted documents |
High EPSS 0.93% |
>= 1.2-milestone-1, < 13.10.11 | 13.10.11 |
| GHSA-4f8g-fq6x-jqrr org.xwiki.platform:xwiki-platform-oldcore vulnerable to data leak through deleted documents |
High EPSS 0.93% |
>= 14.0-rc-1, < 14.4.7 | 14.4.7 |
| GHSA-4f8g-fq6x-jqrr org.xwiki.platform:xwiki-platform-oldcore vulnerable to data leak through deleted documents |
High EPSS 0.93% |
>= 14.5, < 14.10 | 14.10 |
| GHSA-3738-p9x3-mv9r XWiki Platform vulnerable to privilege escalation via properties with wiki syntax that are executed with wrong author |
High EPSS 0.79% |
>= 14.0, < 14.4.7 | 14.4.7 |
| GHSA-3738-p9x3-mv9r XWiki Platform vulnerable to privilege escalation via properties with wiki syntax that are executed with wrong author |
High EPSS 0.79% |
>= 14.5, < 14.10 | 14.10 |
| GHSA-3738-p9x3-mv9r XWiki Platform vulnerable to privilege escalation via properties with wiki syntax that are executed with wrong author |
High EPSS 0.79% |
>= 13.10, < 13.10.11 | 13.10.11 |
| GHSA-92wp-r7hm-42g7 XWiki Platform subject to Uncontrolled Resource Consumption |
High EPSS 0.85% |
< 14.0-rc-1 | 14.0-rc-1 |
| GHSA-4x5r-6v26-7j4v Creation of new database tables through login form on PostgreSQL |
Medium EPSS 0.56% |
>= 14.5.0, < 14.6-rc-1 | 14.6-rc-1 |
| GHSA-4x5r-6v26-7j4v Creation of new database tables through login form on PostgreSQL |
Medium EPSS 0.56% |
< 13.10.8 | 13.10.8 |
| GHSA-4x5r-6v26-7j4v Creation of new database tables through login form on PostgreSQL |
Medium EPSS 0.56% |
>= 14.0.0, < 14.4.2 | 14.4.2 |
| GHSA-2gj2-vj98-j2qq Missing Authorization in User#setDisabledStatus in org.xwiki.platform:xwiki-platform-oldcore |
Medium EPSS 0.79% |
>= 11.7RC1, < 13.10.7 | 13.10.7 |
| GHSA-2gj2-vj98-j2qq Missing Authorization in User#setDisabledStatus in org.xwiki.platform:xwiki-platform-oldcore |
Medium EPSS 0.79% |
>= 14.0.0, < 14.4.2 | 14.4.2 |
| GHSA-g4h6-qp44-wqvx XWiki.WebHome vulnerable to Improper Privilege Management in XWiki resolving groups |
High EPSS 1.45% |
>= 11.3.7, < 13.10.4 | 13.10.4 |
| GHSA-g4h6-qp44-wqvx XWiki.WebHome vulnerable to Improper Privilege Management in XWiki resolving groups |
High EPSS 1.45% |
>= 14.0-rc-1, < 14.2-rc-1 | 14.2-rc-1 |
| GHSA-jgc8-gvcx-9vfx XWiki Platform Improper Authorization check for inactive users |
High EPSS 1.17% |
>= 1.1, < 13.10.5 | 13.10.5 |
| GHSA-jgc8-gvcx-9vfx XWiki Platform Improper Authorization check for inactive users |
High EPSS 1.17% |
>= 14.0, < 14.3-rc-1 | 14.3-rc-1 |
| GHSA-8h89-34w2-jpfm XWiki Platform Old Core vulnerable to Authentication Bypass Using the Login Action |
High EPSS 1.08% |
>= 14.0, < 14.2 | 14.2 |
| GHSA-8h89-34w2-jpfm XWiki Platform Old Core vulnerable to Authentication Bypass Using the Login Action |
High EPSS 1.08% |
< 13.10.4 | 13.10.4 |
| GHSA-9qrp-h7fw-42hg Path Traversal in XWiki Platform |
Low EPSS 1.09% |
>= 8.3-rc-1, < 13.10.3 | 13.10.3 |
| GHSA-h5jm-jjgx-q2wf XWiki Remote Code Execution |
Medium EPSS 1.52% |
>= 0.9.543, < 1.0B1 | 1.0B1 |
| GHSA-9jq9-c2cv-pcrj Cross-site Scripting by SVG upload in xwiki-platform |
Medium EPSS 0.87% |
>= 13.0, < 13.3RC1 | 13.3RC1 |
| GHSA-9jq9-c2cv-pcrj Cross-site Scripting by SVG upload in xwiki-platform |
Medium EPSS 0.87% |
< 12.10.6 | 12.10.6 |
| GHSA-2jhm-qp48-hv5j Missing authorization in xwiki-platform |
Medium EPSS 0.94% |
< 12.10.9 | 12.10.9 |
| GHSA-2jhm-qp48-hv5j Missing authorization in xwiki-platform |
Medium EPSS 0.94% |
>= 13.0.0, < 13.4.3 | 13.4.3 |
| GHSA-2jhm-qp48-hv5j Missing authorization in xwiki-platform |
Medium EPSS 0.94% |
>= 13.6-rc-1, < 13.7-rc-1 | 13.7-rc-1 |
| GHSA-jp55-vvmf-63mv URL Redirection to Untrusted Site ('Open Redirect') |
Medium EPSS 0.80% |
< 12.10.7 | 12.10.7 |
| GHSA-jp55-vvmf-63mv URL Redirection to Untrusted Site ('Open Redirect') |
Medium EPSS 0.80% |
>= 13.0.0, < 13.3RC1 | 13.3RC1 |
| GHSA-gf7x-2j2x-7f73 Missing authorization in xwiki-platform |
Medium EPSS 0.95% |
>= 13.0, < 13.2-rc-1 | 13.2-rc-1 |
| GHSA-gf7x-2j2x-7f73 Missing authorization in xwiki-platform |
Medium EPSS 0.95% |
< 12.10.6 | 12.10.6 |
| GHSA-f4cj-3q3h-884r Partial authorization bypass on document save in xwiki-platform |
Medium EPSS 0.68% |
>= 1.0, < 13.0 | 13.0 |
| GHSA-5c66-v29h-xjh8 XSS Cross Site Scripting |
Critical EPSS 1.12% |
>= 12.6.4, < 12.8 | 12.8 |
| GHSA-5c66-v29h-xjh8 XSS Cross Site Scripting |
Critical EPSS 1.12% |
< 12.6.3 | 12.6.3 |
| GHSA-5hv6-mh8q-q9v8 RCE in XWiki |
High EPSS 3.36% |
< 11.10.6 | 11.10.6 |
| GHSA-5hv6-mh8q-q9v8 RCE in XWiki |
High EPSS 3.36% |
>= 12.0, < 12.5 | 12.5 |
| GHSA-7qw5-pqhc-xm4g Users with SCRIPT right can execute arbitrary code in XWiki |
Medium EPSS 1.34% |
< 11.10.5 | 11.10.5 |
| GHSA-7qw5-pqhc-xm4g Users with SCRIPT right can execute arbitrary code in XWiki |
Medium EPSS 1.34% |
>= 12.0.0, < 12.2.1 | 12.2.1 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor