| Package | Affected versions | Patched versions |
|---|---|---|
| org.xwiki.platform:xwiki-platform-security-authentication-default | ≥ 13.10.8, < 13.10.11≥ 14.4.3, < 14.4.7≥ 14.6, < 14.10 | 13.10.1114.4.714.10 |
| xwiki | = 14.10= 14.6≥ 13.10.8, < 13.10.11≥ 14.4.3, < 14.4.7 | 13.10.1114.4.7 |
It was possible to inject some code using the URL of authenticate endpoints, e.g.:
https://hostname/xwiki/authenticate/wiki/xwiki%22onload=%22alert(origin)%22/resetpassword
This vulnerability was present in recent versions of XWiki:
This problem has been patched on XWiki 13.10.11, 14.4.7 and 14.10.
There is no easy workaround except to upgrade.
If you have any questions or comments about this advisory:
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free