Publish Advisories

GHSA-rp38-24m3-rx87
GHSA-x7wv-5qg4-vmr6

advisories/github-reviewed/2025/04/GHSA-rp38-24m3-rx87/GHSA-rp38-24m3-rx87.json

@@ -1,13 +1,13 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-rp38-24m3-rx87",
-  "modified": "2025-04-29T14:01:48Z",
+  "modified": "2025-04-29T14:03:33Z",
   "published": "2025-04-29T14:01:47Z",
   "aliases": [
     "CVE-2025-32972"
   ],
   "summary": "The lesscss script service allows cache clearing without programming right",
-  "details": "### Impact\nThe script API of the LESS compiler in XWiki is incorrectly checking for rights when calling the cache cleaning API, making it possible to clean the cache without having programming right. The only impact of this is a slowdown in XWiki execution as the caches are re-filled. As this vulnerability requires script right to exploit, and script right already allows unlimited execution of scripts, the additional impact due to this vulnerability is low.\n\n### Patches\nThis has been patched in XWiki 15.10.12, 16.4.3 and 16.8.0 RC1.\n\n### Workarounds\nWe're not aware of any workaround except for being careful whom to give script right, which is a general recommendation.\n\n### References\n* https://jira.xwiki.org/browse/XWIKI-22462\n* https://github.com/xwiki/xwiki-platform/commit/91752122d8782f171f8728004a57bdaefc34253e",
+  "details": "### Impact\nThe script API of the LESS compiler in XWiki is incorrectly checking for rights when calling the cache cleaning API, making it possible to clean the cache without having programming right. The only impact of this is a slowdown in XWiki execution as the caches are re-filled. As this vulnerability requires script right to exploit, and script right already allows unlimited execution of scripts, the additional impact due to this vulnerability is low.\n\n### Patches\nThis has been patched in XWiki 15.10.12, 16.4.3 and 16.8.0 RC1.\n\n### Workarounds\nWe're not aware of any workaround except for being careful whom to give script right, which is a general recommendation.",
   "severity": [
     {
       "type": "CVSS_V3",

advisories/github-reviewed/2025/04/GHSA-x7wv-5qg4-vmr6/GHSA-x7wv-5qg4-vmr6.json

@@ -0,0 +1,103 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-x7wv-5qg4-vmr6",
+  "modified": "2025-04-29T14:03:13Z",
+  "published": "2025-04-29T14:03:13Z",
+  "aliases": [
+    "CVE-2025-32973"
+  ],
+  "summary": "org.xwiki.platform:xwiki-platform-component-wiki provides no warning when granting XWiki.ComponentClass programming right",
+  "details": "### Impact\n\nWhen a user with programming right edits a document in XWiki that was last edited by a user without programming right and contains an `XWiki.ComponentClass`, there is no warning that this will grant programming right to this object. An attacker who created such a malicious object could use this to gain programming right on the wiki. For this, the attacker needs to have edit right on at least one page to place this object and then get an admin user to edit that document.\n\nTo reproduce the problem, as a user without programming right, add an object of type `XWiki.ComponentClass` to any page and then edit the page as a user with programming right. There should be warning displayed, if not, the XWiki installation is vulnerable.\n\nWhile such a warning didn't exist in any version of XWiki, only in XWiki 15.9 RC1 these kinds of warnings have been introduced which is why this is considered the first version that has this vulnerability. Before that, the advice was to be careful when editing pages edited by untrusted users.\n\n### Patches\nThis problem has been patched in XWiki 15.10.2, 16.4.3, and 16.8.0 RC1.\n\n### Workarounds\nWe're not aware of any workarounds apart from not editing pages that might have been edited by untrusted users as a user with programming rights, e.g., by using separate user accounts for admin and non-admin tasks.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "org.xwiki.platform:xwiki-platform-component-wiki"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "15.9-rc-1"
+            },
+            {
+              "fixed": "15.10.12"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "org.xwiki.platform:xwiki-platform-component-wiki"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "16.0.0-rc-1"
+            },
+            {
+              "fixed": "16.4.3"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "org.xwiki.platform:xwiki-platform-component-wiki"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "16.5.0-rc-1"
+            },
+            {
+              "fixed": "16.8.0-rc-1"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-x7wv-5qg4-vmr6"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/xwiki/xwiki-platform/commit/1a6f1b2e050770331c9a63d12a3fd8a36d199f62"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/xwiki/xwiki-platform"
+    },
+    {
+      "type": "WEB",
+      "url": "https://jira.xwiki.org/browse/XWIKI-22460"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-862"
+    ],
+    "severity": "CRITICAL",
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-04-29T14:03:13Z",
+    "nvd_published_at": null
+  }
+}