netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-hmm7-6ph9-8jf2
GHSA-pwfv-3cvg-9m4c
This commit is contained in:
advisory-database[bot]
2025-02-06 20:03:32 +00:00
parent 0236bfd7a5
commit b056cb15e6
2 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2023/04/GHSA-hmm7-6ph9-8jf2/GHSA-hmm7-6ph9-8jf2.json
+2 -2
View File
@@ -1,13 +1,13 @@
{
"schema_version": "1.4.0",
"id": "GHSA-hmm7-6ph9-8jf2",
"modified": "2023-04-26T17:02:56Z",
"modified": "2025-02-06T20:02:37Z",
"published": "2023-04-12T20:36:36Z",
"aliases": [
"CVE-2023-29508"
],
"summary": "org.xwiki.platform:xwiki-platform-livedata-macro vulnerable to Basic Cross-site Scripting",
"details": "### Impact\nA user without script rights can introduce a stored XSS by using the Live Data macro, if the last author of the content of the page has script rights.\n\nFor instance, by adding the LiveData below in the about section of the profile of a user created by an admin.\n\n```javascript\n{{liveData id=\"movies\" properties=\"title,description\"}}\n{\n \"data\": {\n \"count\": 1,\n \"entries\": [\n {\n \"title\": \"Meet John Doe\",\n \"url\": \"https://www.imdb.com/title/tt0033891/\",\n \"description\": \"<img onerror='alert(1)' src='foo' />\"\n }\n ]\n },\n \"meta\": {\n \"propertyDescriptors\": [\n {\n \"id\": \"title\",\n \"name\": \"Title\",\n \"visible\": true,\n \"displayer\": {\"id\": \"link\", \"propertyHref\": \"url\"}\n },\n {\n \"id\": \"description\",\n \"name\": \"Description\",\n \"visible\": true,\n \"displayer\": \"html\"\n }\n ]\n }\n}\n{{/liveData}}\n```\n\n### Patches\nThis has been patched in XWiki 14.10, 14.4.7, and 13.10.11.\n\n### Workarounds\nNo known workaround.\n\n### References\n- https://jira.xwiki.org/browse/XWIKI-20312\n\n### For more information\nIf you have any questions or comments about this advisory:\n\n* Open an issue in [Jira](http://jira.xwiki.org/)\n* Email us at [Security ML](mailto:security@xwiki.org)\n",
"details": "### Impact\nA user without script rights can introduce a stored XSS by using the Live Data macro, if the last author of the content of the page has script rights.\n\nFor instance, by adding the LiveData below in the about section of the profile of a user created by an admin.\n\n```javascript\n{{liveData id=\"movies\" properties=\"title,description\"}}\n{\n \"data\": {\n \"count\": 1,\n \"entries\": [\n {\n \"title\": \"Meet John Doe\",\n \"url\": \"https://www.imdb.com/title/tt0033891/\",\n \"description\": \"<img onerror='alert(1)' src='foo' />\"\n }\n ]\n },\n \"meta\": {\n \"propertyDescriptors\": [\n {\n \"id\": \"title\",\n \"name\": \"Title\",\n \"visible\": true,\n \"displayer\": {\"id\": \"link\", \"propertyHref\": \"url\"}\n },\n {\n \"id\": \"description\",\n \"name\": \"Description\",\n \"visible\": true,\n \"displayer\": \"html\"\n }\n ]\n }\n}\n{{/liveData}}\n```\n\n### Patches\nThis has been patched in XWiki 14.10, 14.4.7, and 13.10.11.\n\n### Workarounds\nNo known workaround.\n\n### References\n- https://jira.xwiki.org/browse/XWIKI-20312\n\n### For more information\nIf you have any questions or comments about this advisory:\n\n* Open an issue in [Jira](http://jira.xwiki.org/)\n* Email us at [Security ML](mailto:security@xwiki.org)",
"severity": [
{
"type": "CVSS_V3",
advisories/github-reviewed/2023/04/GHSA-pwfv-3cvg-9m4c/GHSA-pwfv-3cvg-9m4c.json
+2 -2
View File
@@ -1,13 +1,13 @@
{
"schema_version": "1.4.0",
"id": "GHSA-pwfv-3cvg-9m4c",
"modified": "2023-04-26T20:32:48Z",
"modified": "2025-02-06T20:02:23Z",
"published": "2023-04-12T20:36:28Z",
"aliases": [
"CVE-2023-29507"
],
"summary": "org.xwiki.platform:xwiki-platform-oldcore makes Incorrect Use of Privileged APIs with DocumentAuthors",
"details": "### Impact\n\nThe Document script API returns directly a DocumentAuthors allowing to set any authors to the document, which in consequence can allow subsequent executions of scripts since this author is used for checking rights. \nExample of such attack:\n\n```\n{{velocity}}\n$doc.setContent('{{velocity}}$xcontext.context.authorReference{{/velocity}}')\n$doc.authors.setContentAuthor('xwiki:XWiki.superadmin')\n$doc.getRenderedContent()\n{{/velocity}}\n```\n\n### Patches\nThe problem has been patched in XWiki 14.10 and 14.4.7 by returning a safe script API.\n\n### Workarounds\nThere no easy workaround apart of upgrading. \n\n### References\n\n * https://jira.xwiki.org/browse/XWIKI-20380\n * https://github.com/xwiki/xwiki-platform/commit/905cdd7c421dbf8c565557cdc773ab1aa9028f83\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [Jira](https://jira.xwiki.org)\n* Email us at [security ML](mailto:security@xwiki.org)\n",
"details": "### Impact\n\nThe Document script API returns directly a DocumentAuthors allowing to set any authors to the document, which in consequence can allow subsequent executions of scripts since this author is used for checking rights. \nExample of such attack:\n\n```\n{{velocity}}\n$doc.setContent('{{velocity}}$xcontext.context.authorReference{{/velocity}}')\n$doc.authors.setContentAuthor('xwiki:XWiki.superadmin')\n$doc.getRenderedContent()\n{{/velocity}}\n```\n\n### Patches\nThe problem has been patched in XWiki 14.10 and 14.4.7 by returning a safe script API.\n\n### Workarounds\nThere no easy workaround apart of upgrading. \n\n### References\n\n * https://jira.xwiki.org/browse/XWIKI-20380\n * https://github.com/xwiki/xwiki-platform/commit/905cdd7c421dbf8c565557cdc773ab1aa9028f83\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [Jira](https://jira.xwiki.org)\n* Email us at [security ML](mailto:security@xwiki.org)",
"severity": [
{
"type": "CVSS_V3",