Tmortagne

**Name of the Vulnerable Software and Affected Versions** XWiki Platform versions 6.1-milestone-2 through 16.10.6 **Description** The XWiki Platform is a generic wiki platform. Affected versions allow access to configuration files through the webjars API. This issue is resolved in version 16.10.7. **Recommendations** Update to version 16.10.7 or later.

**Name of the Vulnerable Software and Affected Versions** XWiki Platform versions prior to 15.0 RC1 **Description** The content of a document included using `{{include reference="targetdocument"/}}` is executed with the rights of the includer and not with the rights of its author. This means that any user able to modify the target document can impersonate the author of the content which used the `include` macro. **Recommendations** For versions prior to 15.0 RC1, make sure to protect any included document to ensure only allowed users can modify it. A workaround is available in 14.10.2 to allow forcing the execution of the included content with the target content author instead of the default behavior. Update to XWiki 15.0 RC1 or later, where the default behavior has been made safe.

**Name of the Vulnerable Software and Affected Versions** XWiki Platform versions prior to 14.10.18 XWiki Platform versions prior to 15.5.3 XWiki Platform versions prior to 15.8 RC1 **Description** A user able to attach a file to a page can post a malformed TAR file by manipulating file modification times headers, which when parsed by Tika, could cause a denial of service issue via CPU consumption. **Recommendations** For versions prior to 14.10.18, update to version 14.10.18 or later. For versions prior to 15.5.3, update to version 15.5.3 or later. For versions prior to 15.8 RC1, update to version 15.8 RC1 or later. As a temporary workaround, consider downloading commons-compress 1.24 and replacing the one located in XWiki's WEB-INF/lib/ folder.

**Name of the Vulnerable Software and Affected Versions** XWiki Commons versions prior to 14.10 **Description** The issue concerns rights added to a document not being taken into account for viewing it once it's deleted. This specifically impacts deleted documents that contained view rights. However, view rights provided on a space of a deleted document are properly checked. The problem has been resolved by checking the rights of the current user, allowing only admins and the deleter of the document to view it. **Recommendations** For versions prior to 14.10, update to XWiki 14.10 to resolve the issue by implementing the patch that checks the rights of the current user, restricting viewing of deleted documents to admins and the document's deleter.

**Name of the Vulnerable Software and Affected Versions** XWiki Commons versions prior to 13.10.8 XWiki Commons versions prior to 14.4.3 XWiki Commons versions prior to 14.7RC1 **Description** The issue concerns hidden users from the main wiki, allowing their usernames and first and last names to be disclosed by requesting users on a subwiki that allows only global users with `uorgsuggest.vm`. This issue only affects hidden users from the main wiki, and no other information is leaked. **Recommendations** For versions prior to 13.10.8, update to version 13.10.8 or later. For versions prior to 14.4.3, update to version 14.4.3 or later. For versions prior to 14.7RC1, update to version 14.7RC1 or later. As a temporary workaround, consider patching directly `uorgsuggest.vm` to apply the same changes as in the provided GitHub pull request.

**Name of the Vulnerable Software and Affected Versions** XWiki versions prior to 13.10.10 XWiki versions prior to 14.4.6 XWiki versions prior to 14.9 **Description** The Livetable Macro wasn't properly sanitizing column names, thus allowing the insertion of raw HTML code including JavaScript. This issue was also exploitable via the Documents Macro that is included since XWiki 3.5M1 and doesn't require script rights, demonstrated with the syntax `{{documents id="example" count="5" actions="false" columns="doc.title, before<script>alert(1)</script>after"/}}`. Therefore, this can also be exploited by users without script rights and in comments. With the interaction of a user with more rights, this could be used to execute arbitrary actions in the wiki, including privilege escalation, remote code execution, information disclosure, modifying or deleting content. **Recommendations** For XWiki versions prior to 13.10.10, update to version 13.10.10 or later. For XWiki versions prior to 14.4.6, update to version 14.4.6 or later. For XWiki versions prior to 14.9, update to version 14.9 or later. As a temporary workaround, consider applying the patch to existing installations without upgrading by replacing the files `skins/flamingo/macros.vm` and `templates/macros.vm` in the web application directory with patched versions.

**Name of the Vulnerable Software and Affected Versions** XWiki Platform versions prior to 12.10.6 XWiki Platform versions prior to 13.2CR1 **Description** The issue allows any user with edit rights to copy the content of a page they do not have access to by using it as a template for a new page. There are no known workarounds for this issue. **Recommendations** For versions prior to 12.10.6, update to version 12.10.6 or later. For versions prior to 13.2CR1, update to version 13.2CR1 or later.

**Name of the Vulnerable Software and Affected Versions** XWiki Platform versions prior to 12.10.9 XWiki Platform versions prior to 13.4.1 XWiki Platform versions prior to 13.6RC1 **Description** The issue allows an attacker to guess if a user has an account on the wiki by using the "Forgot your password" form, even if the wiki is closed to guest users. There are no known workarounds for this issue. **Recommendations** For versions prior to 12.10.9, update to version 12.10.9 or later. For versions prior to 13.4.1, update to version 13.4.1 or later. For versions prior to 13.6RC1, update to version 13.6RC1 or later.