Package · Maven

org.xwiki.contrib:application-ckeditor-ui

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

Critical 9.1

CVE-2023-36477

Persistent Cross-site Scripting (XSS) through CKEditor Configuration pages in XWiki Platform

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with edit rights can edit all pages in the `CKEditor' space. This makes it possible to perform a variety of harmful actions, such as removing tec…

xwiki xwiki-platform org.xwiki.contrib:application-ckeditor-ui org.xwiki.platform:xwiki-platform-ckeditor-ui Maven

Jun 30, 2023
Critical 9.1

CVE-2023-22457 EPSS 19%

org.xwiki.contrib:application-ckeditor-ui vulnerable to Remote Code Execution via Cross-Site Request Forgery

CKEditor Integration UI adds support for editing wiki pages using CKEditor. Prior to versions 1.64.3,t he `CKEditor.HTMLConverter` document lacked a protection against Cross-Site Request Forgery (CSRF), allowing to execute macros with the rights of the curren…

xwiki-contrib application-ckeditor request-tracker4 ldap-account-manager Ubuntu Maven

Jan 4, 2023