org.xwiki.platform:xwiki-platform-web-templates (Maven)
Advisories
51
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 17.10.1 or later clears every advisory below that has a fix.
Upgrade commands
maven
<dependency><groupId>org.xwiki.platform</groupId><artifactId>xwiki-platform-web-templates</artifactId><version>17.10.1</version></dependency>gradle
implementation("org.xwiki.platform:xwiki-platform-web-templates:17.10.1")Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-w4fj-87j5-f25c XWiki has Reflected Cross-Site Scripting (XSS) in page history compare |
Medium EPSS 0.55% |
>= 17.5.0-rc-1, < 17.10.1 | 17.10.1 |
| GHSA-w4fj-87j5-f25c XWiki has Reflected Cross-Site Scripting (XSS) in page history compare |
Medium EPSS 0.55% |
>= 10.4-rc-1, < 16.10.16 | 16.10.16 |
| GHSA-w4fj-87j5-f25c XWiki has Reflected Cross-Site Scripting (XSS) in page history compare |
Medium EPSS 0.55% |
>= 17.0.0-rc-1, < 17.4.8 | 17.4.8 |
| GHSA-wvqx-m5px-6cmp XWiki Affected by Reflected Cross-Site Scripting (XSS) in Error Messages |
Medium EPSS 0.55% |
>= 7.0-milestone-2, < 16.10.12 | 16.10.12 |
| GHSA-wvqx-m5px-6cmp XWiki Affected by Reflected Cross-Site Scripting (XSS) in Error Messages |
Medium EPSS 0.55% |
>= 17.0.0-rc-1, < 17.4.5 | 17.4.5 |
| GHSA-wvqx-m5px-6cmp XWiki Affected by Reflected Cross-Site Scripting (XSS) in Error Messages |
Medium EPSS 0.55% |
>= 17.5.0-rc-1, < 17.8.0-rc-1 | 17.8.0-rc-1 |
| GHSA-7vpr-jm38-wr7w XWiki vulnerable to a reflected XSS via xredirect parameter in DeleteApplication |
Medium EPSS 0.51% |
>= 6.2-milestone-1, < 16.10.10 | 16.10.10 |
| GHSA-7vpr-jm38-wr7w XWiki vulnerable to a reflected XSS via xredirect parameter in DeleteApplication |
Medium EPSS 0.51% |
>= 17.0.0-rc-1, < 17.4.2 | 17.4.2 |
| GHSA-m9x4-w7p9-mxhx XWiki allows Reflected XSS in two templates |
Medium EPSS 0.69% |
>= 16.5.0-rc-1, < 16.10.6 | 16.10.6 |
| GHSA-m9x4-w7p9-mxhx XWiki allows Reflected XSS in two templates |
Medium EPSS 0.69% |
>= 4.2-milestone-3, < 16.4.8 | 16.4.8 |
| GHSA-m9x4-w7p9-mxhx XWiki allows Reflected XSS in two templates |
Medium EPSS 0.69% |
>= 17.0.0-rc-1, < 17.3.0-rc-1 | 17.3.0-rc-1 |
| GHSA-f963-4cq8-2gw7 In XWiki Platform, payloads stored in content is executed when a user with script/programming right edit them |
High EPSS 0.68% |
< 15.10-rc-1 | 15.10-rc-1 |
| GHSA-692v-783f-mg8x XWiki Platform vulnerable to Cross-Site Scripting (XSS) through conflict resolution |
Medium EPSS 1.67% |
>= 16.0.0-rc-1, < 16.3.0-rc-1 | 16.3.0-rc-1 |
| GHSA-692v-783f-mg8x XWiki Platform vulnerable to Cross-Site Scripting (XSS) through conflict resolution |
Medium EPSS 1.67% |
>= 11.8-rc-1, < 15.10.8 | 15.10.8 |
| GHSA-93gh-jgjj-r929 XWiki Platform vulnerable to XSS with edit right in the create document form for existing pages |
Medium EPSS 0.75% |
< 14.10.12 | 14.10.12 |
| GHSA-93gh-jgjj-r929 XWiki Platform vulnerable to XSS with edit right in the create document form for existing pages |
Medium EPSS 0.75% |
>= 15.0-rc-1, < 15.5-rc-1 | 15.5-rc-1 |
| GHSA-qcj9-gcpg-4w2w XWiki Platform web templates vulnerable to reflected XSS in the create document form if name validation is enabled |
Critical EPSS 5.38% |
>= 12.0-rc-1, < 14.10.12 | 14.10.12 |
| GHSA-qcj9-gcpg-4w2w XWiki Platform web templates vulnerable to reflected XSS in the create document form if name validation is enabled |
Critical EPSS 5.38% |
>= 15.0-rc-1, < 15.5-rc-1 | 15.5-rc-1 |
| GHSA-ghf6-2f42-mjh9 XWiki users can be tricked to execute scripts as the create page action doesn't display the page's title |
High EPSS 1.91% |
< 14.10.12 | 14.10.12 |
| GHSA-ghf6-2f42-mjh9 XWiki users can be tricked to execute scripts as the create page action doesn't display the page's title |
High EPSS 1.91% |
>= 15.0-rc-1, < 15.5-rc-1 | 15.5-rc-1 |
| GHSA-gr82-8fj2-ggc3 XWiki Platform XSS vulnerability from account in the create page form via template provider |
Critical EPSS 2.02% |
>= 15.0-rc-1, < 15.5-rc-1 | 15.5-rc-1 |
| GHSA-gr82-8fj2-ggc3 XWiki Platform XSS vulnerability from account in the create page form via template provider |
Critical EPSS 2.02% |
< 14.10.12 | 14.10.12 |
| GHSA-h8cm-3v5f-rgp6 XWiki Platform Stored Cross-site Scripting in the user profile via the timezone displayer |
Medium EPSS 79.99% |
>= 4.1-milestone-2, < 14.10.5 | 14.10.5 |
| GHSA-r8xc-xxh3-q5x3 XWiki Platform vulnerable to reflected cross-site scripting via back and xcontinue parameters in resubmit template |
Medium EPSS 2.27% |
>= 15.0-rc-1, < 15.1-rc-1 | 15.1-rc-1 |
| GHSA-r8xc-xxh3-q5x3 XWiki Platform vulnerable to reflected cross-site scripting via back and xcontinue parameters in resubmit template |
Medium EPSS 2.27% |
>= 2.5-milestone-2, < 14.10.5 | 14.10.5 |
| GHSA-x234-mg7q-m8g8 XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in deletespace template |
Medium EPSS 2.18% |
>= 15.0-rc-1, < 15.1-rc-1 | 15.1-rc-1 |
| GHSA-x234-mg7q-m8g8 XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in deletespace template |
Medium EPSS 2.18% |
>= 3.4-milestone-1, < 14.10.5 | 14.10.5 |
| GHSA-fp7h-f9f5-x4q7 XWiki vulnerable to stored cross-site scripting via any wiki document and the displaycontent/rendercontent template |
Medium EPSS 0.71% |
>= 15.0-rc-1, < 15.1-rc-1 | 15.1-rc-1 |
| GHSA-fp7h-f9f5-x4q7 XWiki vulnerable to stored cross-site scripting via any wiki document and the displaycontent/rendercontent template |
Medium EPSS 0.71% |
< 14.4.8 | 14.4.8 |
| GHSA-fp7h-f9f5-x4q7 XWiki vulnerable to stored cross-site scripting via any wiki document and the displaycontent/rendercontent template |
Medium EPSS 0.71% |
>= 14.5, < 14.10.5 | 14.10.5 |
| GHSA-fp36-mjw5-fmgx xwiki-platform-web-templates allows users to be created even when registration is disabled without validation via template macro |
Medium EPSS 0.67% |
>= 8.0-rc-1, < 14.10.1 | 14.10.1 |
| GHSA-hg5x-3w3x-7g96 xwiki-platform-web-templates vulnerable to Eval Injection |
High EPSS 1.14% |
>= 14.5, < 14.10.1 | 14.10.1 |
| GHSA-hg5x-3w3x-7g96 xwiki-platform-web-templates vulnerable to Eval Injection |
High EPSS 1.14% |
>= 1.0B1, < 13.10.11 | 13.10.11 |
| GHSA-hg5x-3w3x-7g96 xwiki-platform-web-templates vulnerable to Eval Injection |
High EPSS 1.14% |
>= 14.0-rc-1, < 14.4.8 | 14.4.8 |
| GHSA-6vgh-9r3c-2cxp Improper Neutralization of Script-Related HTML Tags (XSS) in the LiveTable Macro |
Critical EPSS 1.39% |
>= 14.5, < 14.9 | 14.9 |
| GHSA-6vgh-9r3c-2cxp Improper Neutralization of Script-Related HTML Tags (XSS) in the LiveTable Macro |
Critical EPSS 1.39% |
>= 1.9-milestone-2, < 13.10.10 | 13.10.10 |
| GHSA-6vgh-9r3c-2cxp Improper Neutralization of Script-Related HTML Tags (XSS) in the LiveTable Macro |
Critical EPSS 1.39% |
>= 14.0-rc-1, < 14.4.6 | 14.4.6 |
| GHSA-vvp7-r422-rx83 Unauthenticated user can have information about hidden users on subwikis through uorgsuggest.vm |
Medium EPSS 0.70% |
>= 14.5, < 14.7-rc-1 | 14.7-rc-1 |
| GHSA-vvp7-r422-rx83 Unauthenticated user can have information about hidden users on subwikis through uorgsuggest.vm |
Medium EPSS 0.70% |
>= 13.9-rc-1, < 13.10.8 | 13.10.8 |
| GHSA-vvp7-r422-rx83 Unauthenticated user can have information about hidden users on subwikis through uorgsuggest.vm |
Medium EPSS 0.70% |
>= 14.0-rc-1, < 14.4.3 | 14.4.3 |
| GHSA-fxwr-4vq9-9vhj XWiki Cross-Site Request Forgery (CSRF) for actions on tags |
Medium EPSS 0.42% |
>= 2.0-milestone-1, < 13.10.5 | 13.10.5 |
| GHSA-fxwr-4vq9-9vhj XWiki Cross-Site Request Forgery (CSRF) for actions on tags |
Medium EPSS 0.42% |
>= 14.0, < 14.3 | 14.3 |
| GHSA-599v-w48h-rjrm XWiki Platform Web Templates vulnerable to Missing Authorization, Exposure of Private Personal Information to Unauthorized Actor |
High EPSS 0.83% |
>= 1.3, < 13.10.4 | 13.10.4 |
| GHSA-h5j3-5x63-p8jv XWiki Platform Web Templates vulnerable to Unauthorized User Registration Through the Distribution Wizard |
High EPSS 0.88% |
< 13.10.5 | 13.10.5 |
| GHSA-h5j3-5x63-p8jv XWiki Platform Web Templates vulnerable to Unauthorized User Registration Through the Distribution Wizard |
High EPSS 0.88% |
>= 14.0, < 14.3-rc-1 | 14.3-rc-1 |
| GHSA-97jg-43c9-q6pf Unauthenticated user can retrieve the list of users through uorgsuggest.vm |
Medium EPSS 3.20% |
>= 13.5.0, < 13.9 | 13.9 |
| GHSA-97jg-43c9-q6pf Unauthenticated user can retrieve the list of users through uorgsuggest.vm |
Medium EPSS 3.20% |
>= 13.0.0, < 13.4.4 | 13.4.4 |
| GHSA-97jg-43c9-q6pf Unauthenticated user can retrieve the list of users through uorgsuggest.vm |
Medium EPSS 3.20% |
< 12.10.11 | 12.10.11 |
| GHSA-gx6h-936c-vrrr Cross site scripting in registration template in xwiki-platform |
High EPSS 1.01% |
>= 13.10.0, < 13.10.3 | 13.10.3 |
| GHSA-gx6h-936c-vrrr Cross site scripting in registration template in xwiki-platform |
High EPSS 1.01% |
>= 13.0.0, < 13.4.7 | 13.4.7 |
| GHSA-gx6h-936c-vrrr Cross site scripting in registration template in xwiki-platform |
High EPSS 1.01% |
>= 2.6.1, < 12.10.11 | 12.10.11 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor