| Package | Affected versions | Patched versions |
|---|---|---|
| org.xwiki.platform:xwiki-platform-web-templates | ≥ 17.0.0-rc-1, < 17.4.5≥ 17.5.0-rc-1, < 17.8.0-rc-1≥ 7.0-milestone-2, < 16.10.12 | 17.4.517.8.0-rc-116.10.12 |
| xwiki | = 17.0.0= 7.0≥ 17.0.1, < 17.4.5≥ 17.6.0, < 17.8.0≥ 7.0.1, < 16.10.12 | 17.4.517.8.016.10.12 |
| xwiki-rendering | = 17.5.0 |
A reflected cross site scripting (XSS) vulnerability in XWiki allows an attacker to execute arbitrary actions in XWiki with the rights of the victim if the attacker manages to trick a victim into visiting a crafted URL. If the victim has administrative or programming rights, those rights can be exploited to gain full access to the XWiki installation.
This vulnerability has been patched in XWiki 17.8.0RC1, 17.4.5 and 16.10.12.
The patch can be applied manually, only a single line in templates/logging_macros.vm needs to be changed, no restart is required.
We thank Mike Cole @mikecole-mg for discovering and reporting this vulnerability.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free