| Package | Affected versions | Patched versions |
|---|---|---|
| org.xwiki.platform:xwiki-platform-filter-ui | ≥ 13.0.0, < 13.4.7≥ 13.5.0, < 13.10.3≥ 5.4.4, < 12.10.11 | 13.4.713.10.312.10.11 |
| xwiki | ≥ 13.0, < 13.4.7≥ 13.5, < 13.10.3≥ 5.4.4, < 12.10.11 | 13.4.713.10.312.10.11 |
We found a possible XSS vector in the Filter.FilterStreamDescriptorForm wiki page related to pretty much all the form fields printed in the home page of the application.
The issue is patched in versions 12.10.11, 14.0-rc-1, 13.4.7, 13.10.3.
The easiest workaround is to edit the wiki page Filter.FilterStreamDescriptorForm (with wiki editor) and change the lines
<input type="text" id="$descriptorId" name="$descriptorId" value="#if($request.get($descriptorId))$request.get($descriptorId)#else$descriptor.defaultValue#end"/>
#else
<input type="text" id="$descriptorId" name="$descriptorId"#if($request.get($descriptorId))value="$request.get($descriptorId)"#end/>
into
<input type="text" id="$descriptorId" name="$descriptorId" value="#if($request.get($descriptorId))$escapetool.xml($request.get($descriptorId))#else$descriptor.defaultValue#end"/>
#else
<input type="text" id="$descriptorId" name="$descriptorId"#if($request.get($descriptorId))value="$escapetool.xml($request.get($descriptorId))"#end/>
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free