Skip to content
OpenAdvisories

Package · Maven

org.xwiki.platform:xwiki-platform-attachment-ui

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Critical 9.9
    CVE-2023-29516 EPSS 66%

    Code injection from view right on XWiki.AttachmentSelector in xwiki-platform

    XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with view rights on `XWiki.AttachmentSelector` can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki…

    xwiki xwiki-platform org.xwiki.platform:xwiki-platform-attachment-ui Maven
  • Critical 9.1
    CVE-2023-29519

    Code injection in org.xwiki.platform:xwiki-platform-attachment-ui

    XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A registered user can perform remote code execution leading to privilege escalation by injecting the proper code in the "property" field of an attachment …

    xwiki xwiki-platform org.xwiki.platform:xwiki-platform-attachment-ui Maven
  • Critical 9.9
    CVE-2022-41928

    XWiki Platform vulnerable to Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in AttachmentSelector.xml

    XWiki Platform vulnerable to Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in AttachmentSelector.xml. The issue can also be reproduced by inserting the dangerous payload in the `height` or `alt` macro properties. This …

    xwiki xwiki-platform org.xwiki.platform:xwiki-platform-attachment-ui Maven