Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-31451 State: PUBLISHED Published: 2024-04-16T14:28:11.435Z Last Updated: 2024-08-02T01:52:56.966Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: arc53 Products: DocsGPT Problem Types: CWE-22 Description: DocsGPT is a GPT-powered chat for documentation. DocsGPT is vulnerable to unauthenticated limited file write in routes.py. This vulnerability is fixed in 0.8.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/arc53/DocsGPT/security/advisories/GHSA-p5qc-vj2x-9rjp - https://github.com/arc53/DocsGPT/commit/d36f58230a326ecacb9c32a4ae8eac65666044f2 - https://securitylab.github.com/advi
- https://github.com/arc53/DocsGPT/commit/d36f58230a326ecacb9c32a4ae8eac65666044f2 - https://securitylab.github.com/advisories/GHSL-2023-250_DocsGPT
CVE ID: CVE-2024-31452 State: PUBLISHED Published: 2024-04-16T21:40:58.856Z Last Updated: 2024-08-02T01:52:56.950Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: openfga Products: openfga Problem Types: CWE-863 Description: OpenFGA is a high-performance and flexible authorization/permission engine. Some end users of OpenFGA v1.5.0 or later are vulnerable to authorization bypass when calling Check or ListObjects APIs. You are very likely affected if your model involves exclusion (e.g. `a but not b`) or intersection (e.g. `a and b`). This vulnerability is fixed in v1.5.3. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: -
erability is fixed in v1.5.3. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/openfga/openfga/security/advisories/GHSA-8cph-m685-6v6r - https://github.com/openfga/openfga/commit/b6a6d99b2bdbf8c3781503989576076289f48ed2
CVE ID: CVE-2024-31453 State: PUBLISHED Published: 2024-04-09T17:12:49.408Z Last Updated: 2024-08-02T01:52:56.956Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: psi-4ward Products: psitransfer Problem Types: CWE-434 Description: PsiTransfer is an open source, self-hosted file sharing solution. Prior to version 2.2.0, the absence of restrictions on the endpoint, which allows users to create a path for uploading a file in a file distribution, allows an attacker to add arbitrary files to the distribution. The vulnerability allows an attacker to influence those users who come to the file distribution after them and slip the victim files with a malicious or phi
to influence those users who come to the file distribution after them and slip the victim files with a malicious or phishing signature. Version 2.2.0 contains a patch for the issue. CVE-2024-31453 allows users to violate the integrity of a file bucket and upload new files there, while the vulnerability with the number CVE-2024-31454 allows users to violate the integrity of a single file that is uploaded by another user by writing data there and not allows you to upload new files to the bucket. Thus, vulnerabilities are reproduced differently, require different security recommendations and affect different objects of the application’s business logic. Additional Analyst Notes: - CISA ADP Vuln
ommendations and affect different objects of the application’s business logic. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/psi-4ward/psitransfer/security/advisories/GHSA-xg8v-m2mh-45m6 - https://github.com/psi-4ward/psitransfer/commit/b9853c97e6911e1c1c5341245ca1eb363fda5269
CVE ID: CVE-2024-31454 State: PUBLISHED Published: 2024-04-09T17:19:24.991Z Last Updated: 2024-09-04T14:25:47.907Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: psi-4ward Products: psitransfer Problem Types: CWE-434 Description: PsiTransfer is an open source, self-hosted file sharing solution. Prior to version 2.2.0, the absence of restrictions on the endpoint, which is designed for uploading files, allows an attacker who received the id of a file distribution to change the files that are in this distribution. The vulnerability allows an attacker to influence those users who come to the file distribution after them and slip the victim files with a maliciou
attacker to influence those users who come to the file distribution after them and slip the victim files with a malicious or phishing signature. Version 2.2.0 contains a patch for this issue. CVE-2024-31454 allows users to violate the integrity of a file that is uploaded by another user. In this case, additional files are not loaded into the file bucket. Violation of integrity at the level of individual files. While the vulnerability with the number CVE-2024-31453 allows users to violate the integrity of a file bucket without violating the integrity of files uploaded by other users. Thus, vulnerabilities are reproduced differently, require different security recommendations and affect differ
er users. Thus, vulnerabilities are reproduced differently, require different security recommendations and affect different objects of the application’s business logic. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/psi-4ward/psitransfer/security/advisories/GHSA-2p2x-p7wj-j5h2 - https://github.com/psi-4ward/psitransfer/commit/0014d81141e0f1664ccb6841970ef1ea0237cca3
CVE ID: CVE-2024-31455 State: PUBLISHED Published: 2024-04-09T16:52:03.254Z Last Updated: 2024-08-02T01:52:56.973Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: stacklok Products: minder Problem Types: CWE-200 Description: Minder by Stacklok is an open source software supply chain security platform. A refactoring in commit `5c381cf` added the ability to get GitHub repositories registered to a project without specifying a specific provider. Unfortunately, the SQL query for doing so was missing parenthesis, and would select a random repository. This issue is patched in pull request 2941. As a workaround, revert prior to `5c381cf`, or roll forward past `2eb94
ory. This issue is patched in pull request 2941. As a workaround, revert prior to `5c381cf`, or roll forward past `2eb94e7`. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/stacklok/minder/security/advisories/GHSA-ggp5-28x4-xcj9 - https://github.com/stacklok/minder/pull/2941 - https://github.com/stacklok/minder/commit/11b6573ad62cfdd783a8bb52f3fce461466037f4 - https://github.com/stacklok/minder/commit/5c381cfbf3e4b7ce040ed8511a1fae1a78a0014b
CVE ID: CVE-2024-31456 State: PUBLISHED Published: 2024-05-07T14:07:08.277Z Last Updated: 2024-08-02T01:52:56.947Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: glpi-project Products: glpi Problem Types: CWE-89 Description: GLPI is a Free Asset and IT Management Software package. Prior to 10.0.15, an authenticated user can exploit a SQL injection vulnerability from map search. This vulnerability is fixed in 10.0.15. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/glpi-project/glpi/security/advisories/GHSA-gcj4-2cp3-6h5j - https://github.com/glpi-project/glpi/commit/730c3db29a1edc32f9b9d1e2a940e90a0
/security/advisories/GHSA-gcj4-2cp3-6h5j - https://github.com/glpi-project/glpi/commit/730c3db29a1edc32f9b9d1e2a940e90a0211ab26
CVE ID: CVE-2024-31457 State: PUBLISHED Published: 2024-04-09T17:39:52.347Z Last Updated: 2024-08-02T01:52:57.064Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:H) Vendors: flipped-aurora Products: gin-vue-admin Problem Types: CWE-22 Description: gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. gin-vue-admin pseudoversion 0.0.0-20240407133540-7bc7c3051067, corresponding to version 2.6.1, has a code injection vulnerability in the backend. In the Plugin System -> Plugin Template feature, an attacker can perform directory traversal by manipulating the `plugName` parameter. They can create specific fo
ature, an attacker can perform directory traversal by manipulating the `plugName` parameter. They can create specific folders such as `api`, `config`, `global`, `model`, `router`, `service`, and `main.go` function within the specified traversal directory. Moreover, the Go files within these folders can have arbitrary code inserted based on a specific PoC parameter. The main reason for the existence of this vulnerability is the controllability of the PlugName field within the struct. Pseudoversion 0.0.0-20240409100909-b1b7427c6ea6, corresponding to commit b1b7427c6ea6c7a027fa188c6be557f3795e732b, contains a patch for the issue. As a workaround, one may manually use a filtering method availabl
a188c6be557f3795e732b, contains a patch for the issue. As a workaround, one may manually use a filtering method available in the GitHub Security Advisory to rectify the directory traversal problem. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/flipped-aurora/gin-vue-admin/security/advisories/GHSA-gv3w-m57p-3wc4 - https://github.com/flipped-aurora/gin-vue-admin/commit/b1b7427c6ea6c7a027fa188c6be557f3795e732b - https://pkg.go.dev/github.com/flipped-aurora/gin-vue-admin/server?tab=versions
CVE ID: CVE-2024-31458 State: PUBLISHED Published: 2024-05-13T15:07:08.051Z Last Updated: 2025-11-04T16:11:59.883Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L) Vendors: Cacti Products: cacti Problem Types: CWE-89 Description: Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, some of the data stored in `form_save()` function in `graph_template_inputs.php` is not thoroughly checked and is used to concatenate the SQL statement in `draw_nontemplated_fields_graph_item()` function from `lib/html_form_templates.php` , finally resulting in SQL injection. Version 1.2.27 contains a patch for the issue. Additional Analyst Notes
lates.php` , finally resulting in SQL injection. Version 1.2.27 contains a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Cacti/cacti/security/advisories/GHSA-jrxg-8wh8-943x - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RBEOAFKRARQHTDIYSL723XAFJ2Q6624X/
CVE ID: CVE-2024-31459 State: PUBLISHED Published: 2024-05-13T15:11:37.909Z Last Updated: 2025-11-04T16:12:00.875Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Cacti Products: cacti Problem Types: CWE-98 Description: Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, there is a file inclusion issue in the `lib/plugin.php` file. Combined with SQL injection vulnerabilities, remote code execution can be implemented. There is a file inclusion issue with the `api_plugin_hook()` function in the `lib/plugin.php` file, which reads the plugin_hooks and plugin_config tables in database. The read data is directly used to
/plugin.php` file, which reads the plugin_hooks and plugin_config tables in database. The read data is directly used to concatenate the file path which is used for file inclusion. Version 1.2.27 contains a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Cacti/cacti/security/advisories/GHSA-cx8g-hvq8-p2rv - https://github.com/Cacti/cacti/security/advisories/GHSA-gj3f-p326-gh8r - https://github.com/Cacti/cacti/security/advisories/GHSA-pfh9-gwm6-86vp - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RBEOAFKRARQHTDIYSL723XAFJ2Q6624X/
CVE ID: CVE-2024-31460 State: PUBLISHED Published: 2024-05-13T15:14:38.689Z Last Updated: 2025-11-04T16:12:03.775Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: Cacti Products: cacti Problem Types: CWE-89 Description: Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, some of the data stored in `automation_tree_rules.php` is not thoroughly checked and is used to concatenate the SQL statement in `create_all_header_nodes()` function from `lib/api_automation.php` , finally resulting in SQL injection. Using SQL based secondary injection technology, attackers can modify the contents of the Cacti database, and based
tion. Using SQL based secondary injection technology, attackers can modify the contents of the Cacti database, and based on the modified content, it may be possible to achieve further impact, such as arbitrary file reading, and even remote code execution through arbitrary file writing. Version 1.2.27 contains a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Cacti/cacti/security/advisories/GHSA-gj3f-p326-gh8r - https://github.com/Cacti/cacti/security/advisories/GHSA-cx8g-hvq8-p2rv - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RBEOAFKRARQHTDIYSL723XAFJ2Q6624X/
CVE ID: CVE-2024-31461 State: PUBLISHED Published: 2024-04-10T17:25:30.166Z Last Updated: 2024-08-20T18:47:08.605Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: makeplane Products: plane Problem Types: CWE-918 Description: Plane, an open-source project management tool, has a Server-Side Request Forgery (SSRF) vulnerability in versions prior to 0.17-dev. This issue may allow an attacker to send arbitrary requests from the server hosting the application, potentially leading to unauthorized access to internal systems. The impact of this vulnerability includes, but is not limited to, unauthorized access to internal services accessible from the server, potent
lnerability includes, but is not limited to, unauthorized access to internal services accessible from the server, potential leakage of sensitive information from internal services, manipulation of internal systems by interacting with internal APIs. Version 0.17-dev contains a patch for this issue. Those who are unable to update immediately may mitigate the issue by restricting outgoing network connections from servers hosting the application to essential services only and/or implementing strict input validation on URLs or parameters that are used to generate server-side requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/make
uests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/makeplane/plane/security/advisories/GHSA-j77v-w36v-63v6 - https://github.com/makeplane/plane/pull/3323 - https://github.com/makeplane/plane/pull/3333 - https://github.com/makeplane/plane/commit/4b0ccea1461b7ca38761dfe0d0f07c2f94425005 - https://github.com/makeplane/plane/commit/d887b780aea5efba3f3d28c47d7d83f8b3e1e21c - https://securitylab.github.com/advisories/GHSL-2023-257_makeplane_plane
CVE ID: CVE-2024-31462 State: PUBLISHED Published: 2024-04-12T21:41:46.345Z Last Updated: 2024-08-02T01:52:57.047Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: AUTOMATIC1111 Products: stable-diffusion-webui Problem Types: CWE-22 Description: stable-diffusion-webui is a web interface for Stable Diffusion, implemented using Gradio library. Stable-diffusion-webui 1.7.0 is vulnerable to a limited file write affecting Windows systems. The create_ui method (Backup/Restore tab) in modules/ui_extensions.py takes user input into the config_save_name variable on line 653. This user input is later used in the save_config_state method and used to create a file path o
ame variable on line 653. This user input is later used in the save_config_state method and used to create a file path on line 65, which is afterwards opened for writing on line 67, which leads to a limited file write exploitable on Windows systems. This issue may lead to limited file write. It allows for writing json files anywhere on the server where the web server has access. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://securitylab.github.com/advisories/GHSL-2024-010_stable-diffusion-webui/ - https://github.com/AUTOMATIC1111/stable-diffusion-webui/commit/d9708c92b444894bce8070e4dcfaa093f8eb8d43 - https://github.com/AUTOMATIC1111/stable-
IC1111/stable-diffusion-webui/commit/d9708c92b444894bce8070e4dcfaa093f8eb8d43 - https://github.com/AUTOMATIC1111/stable-diffusion-webui/blob/cf2772fab0af5573da775e7437e6acdca424f26e/modules/ui_extensions.py#L59 - https://github.com/AUTOMATIC1111/stable-diffusion-webui/blob/cf2772fab0af5573da775e7437e6acdca424f26e/modules/ui_extensions.py#L646-L660 - https://github.com/AUTOMATIC1111/stable-diffusion-webui/blob/cf2772fab0af5573da775e7437e6acdca424f26e/modules/ui_extensions.py#L65 - https://github.com/AUTOMATIC1111/stable-diffusion-webui/blob/cf2772fab0af5573da775e7437e6acdca424f26e/modules/ui_extensions.py#L653 - https://github.com/AUTOMATIC1111/stable-diffusion-webui/blob/cf2772fab0af5573da77
24f26e/modules/ui_extensions.py#L653 - https://github.com/AUTOMATIC1111/stable-diffusion-webui/blob/cf2772fab0af5573da775e7437e6acdca424f26e/modules/ui_extensions.py#L67 - https://github.com/AUTOMATIC1111/stable-diffusion-webui/blob/v1.7.0/modules/ui_extensions.py - https://github.com/AUTOMATIC1111/stable-diffusion-webui/discussions/15461 - https://securitylab.github.com/advisories/GHSL-2024-010_stable-diffusion-webui
CVE ID: CVE-2024-31463 State: PUBLISHED Published: 2024-04-17T15:21:49.384Z Last Updated: 2024-08-02T01:52:57.081Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: metal3-io Products: ironic-image Problem Types: CWE-288 Description: Ironic-image is an OpenStack Ironic deployment packaged and configured by Metal3. When the reverse proxy mode is enabled by the `IRONIC_REVERSE_PROXY_SETUP` variable set to `true`, 1) HTTP basic credentials are validated on the HTTPD side in a separate container, not in the Ironic service itself and 2) Ironic listens in host network on a private port 6388 on localhost by default. As a result, when the reverse proxy mode is used, a
tens in host network on a private port 6388 on localhost by default. As a result, when the reverse proxy mode is used, any Pod or local Unix user on the control plane Node can access the Ironic API on the private port without authentication. A similar problem affects Ironic Inspector (`INSPECTOR_REVERSE_PROXY_SETUP` set to `true`), although the attack potential is smaller there. This issue affects operators deploying ironic-image in the reverse proxy mode, which is the recommended mode when TLS is used (also recommended), with the `IRONIC_PRIVATE_PORT` variable unset or set to a numeric value. In this case, an attacker with enough privileges to launch a pod on the control plane with host net
to a numeric value. In this case, an attacker with enough privileges to launch a pod on the control plane with host networking can access Ironic API and use it to modify bare-metal machine, e.g. provision them with a new image or change their BIOS settings. This vulnerability is fixed in 24.1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/metal3-io/ironic-image/security/advisories/GHSA-g2cm-9v5f-qg7r - https://github.com/metal3-io/ironic-image/pull/494 - https://github.com/metal3-io/ironic-image/commit/48e40bd30d49aefabac6fc80204a8650b13d10b4
CVE ID: CVE-2024-31464 State: PUBLISHED Published: 2024-04-10T18:14:37.224Z Last Updated: 2024-08-13T13:37:19.841Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-200 Description: XWiki Platform is a generic wiki platform. Starting in version 5.0-rc-1 and prior to versions 14.10.19, 15.5.4, and 15.9-rc-1, it is possible to access the hash of a password by using the diff feature of the history whenever the object storing the password is deleted. Using that vulnerability it's possible for an attacker to have access to the hash password of a user if they have rights to edit the users' page. With the default righ
ttacker to have access to the hash password of a user if they have rights to edit the users' page. With the default right scheme in XWiki this vulnerability is normally prevented on user profiles, except by users with Admin rights. Note that this vulnerability also impacts any extensions that might use passwords stored in xobjects: for those usecases it depends on the right of those pages. There is currently no way to be 100% sure that this vulnerability has been exploited, as an attacker with enough privilege could have deleted the revision where the xobject was deleted after rolling-back the deletion. But again, this operation requires high privileges on the target page (Admin right). A pa
ter rolling-back the deletion. But again, this operation requires high privileges on the target page (Admin right). A page with a user password xobject which have in its history a revision where the object has been deleted should be considered at risk and the password should be changed there. a diff, to ensure it's not coming from a password field. As another mitigation, admins should ensure that the user pages are properly protected: the edit right shouldn't be allowed for other users than Admin and owner of the profile (which is the default right). There is not much workaround possible for a privileged user other than upgrading XWiki. Additional Analyst Notes: - CISA ADP Vulnrichment: - CV
round possible for a privileged user other than upgrading XWiki. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-v782-xr4w-3vqx - https://github.com/xwiki/xwiki-platform/commit/9075668a4135cce114ef2a4b72eba3161a9e94c4 - https://github.com/xwiki/xwiki-platform/commit/955fb097e02a2a7153f527522ee9eef42447e5d7 - https://github.com/xwiki/xwiki-platform/commit/f1eaec1e512220fabd970d053c627e435a1652cf - https://jira.xwiki.org/browse/XWIKI-19948
CVE ID: CVE-2024-31465 State: PUBLISHED Published: 2024-04-10T19:12:35.517Z Last Updated: 2024-08-13T13:56:21.898Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-95 Description: XWiki Platform is a generic wiki platform. Starting in version 5.0-rc-1 and prior to versions 14.10.20, 15.5.4, and 15.9-rc-1, any user with edit right on any page can execute any code on the server by adding an object of type `XWiki.SearchSuggestSourceClass` to their user profile or any other page. This compromises the confidentiality, integrity and availability of the whole XWiki installation. This vulnerability has been patched i
s the confidentiality, integrity and availability of the whole XWiki installation. This vulnerability has been patched in XWiki 14.10.20, 15.5.4 and 15.10 RC1. As a workaround, manually apply the patch to the document `XWiki.SearchSuggestSourceSheet`. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-34fj-r5gq-7395 - https://github.com/xwiki/xwiki-platform/commit/0317a3aa78065e66c86fc725976b06bf7f9b446e - https://github.com/xwiki/xwiki-platform/commit/2740974c32dbb7cc565546d0f04e2374b32b36f7 - https://github.com/xwiki/xwiki-platform/commit/6a7f19f6424036fce3d703413137adde950ae809 - https:
546d0f04e2374b32b36f7 - https://github.com/xwiki/xwiki-platform/commit/6a7f19f6424036fce3d703413137adde950ae809 - https://github.com/xwiki/xwiki-platform/commit/6a7f19f6424036fce3d703413137adde950ae809#diff-67b473d2b6397d65b7726c6a13555850b11b10128321adf9e627e656e1d130a5 - https://jira.xwiki.org/browse/XWIKI-21474