| Package | Affected versions | Patched versions |
|---|---|---|
| org.xwiki.platform:xwiki-platform-oldcore | ≥ 1.1.2, < 14.10.21≥ 15.0-rc-1, < 15.5.5≥ 15.6-rc-1, < 15.10.6≥ 16.0.0-rc-1, < 16.0.0 | 14.10.2115.5.515.10.616.0.0 |
| xwiki | ≥ 15.0, < 15.5.5≥ 15.6, < 15.10.6< 14.10.21 | 15.5.515.10.614.10.21 |
Is it possible for a user without Script or Programming rights to craft a URL pointing to a page with arbitrary JavaScript. This requires social engineer to trick a user to follow the URL.
" + alert(1) + " (the quotes need to be part of the name)."test".<xwiki-server>/xwiki/bin/view/%22%20%2B%20alert(1)%20%2B%20%22/?viewer=display&type=object&property=%22%20%2B%20alert(1)%20%2B%20%22.WebHome.test&mode=edit where <xwiki-server> is the URL of your XWiki installation.This has been patched in XWiki 14.10.21, 15.5.5, 15.10.6 and 16.0.0.
We're not aware of any workaround except upgrading.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free