GitHub Advisoryadvisory · Maven

GHSA-9jq5-xwqw-q8j3 XWiki Platform vulnerable to page render failure due to broken translations

MEDIUM Published 2023-04-20 Modified 2023-04-20 Official page ↗
Aliases
CVE-2023-29520
Ecosystem
Maven
Packages
org.xwiki.platform:xwiki-platform-localization-source-wiki
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-248, CWE-755
Reviewed
2023-04-20

Affected packages

• Maven org.xwiki.platform:xwiki-platform-localization-source-wiki: >= 4.3-milestone-2, < 13.10.11 → fixed in 13.10.11 • Maven org.xwiki.platform:xwiki-platform-localization-source-wiki: >= 14.0-rc-1, < 14.4.8 → fixed in 14.4.8 • Maven org.xwiki.platform:xwiki-platform-localization-source-wiki: >= 14.5, < 14.10.1 → fixed in 14.10.1

Description

Impact It's possible to break many translations coming from wiki pages by creating a corrupted document containing a translation object. Patches The vulnerability has been patched in XWiki 15.0-rc-1, 14.10.1, 14.4.8, and 13.10.11. Workarounds There is no other workaround other than fixing any way to create a document that fail to load. References https://jira.xwiki.org/browse/XWIKI-20460 For more information If you have any questions or comments about this advisory: • Open an issue in Jira XWiki.org • Email us at Security Mailing List

Related

Alias · CVE (1)

  • CVE-2023-29520 XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. vulnerability

Weakness · CWE (2)

  • CWE-248 Uncaught Exception weakness
  • CWE-755 Improper Handling of Exceptional Conditions weakness

References