Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2021-41093: Incorrect Authorization (CWE-863)
value: Wire is an open source secure messenger. In affected versions if the an attacker gets an old but valid access token they can take over an account by changing the email. This issue has been resolved in version 3.86 which uses a new endpoint which additionally requires an authentication cookie. See wire-ios-sync-engine and wire-ios-transport references. This is the root advisory that pulls the changes together.
CWE description: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
CVSS v3 base score: 9.8
Published: 2021-10-04T19:15Z
Repository: https://github.com/wireapp/wire-ios
Language: Other
Files changed: Cartfile.resolved
Commit date: 2021-08-02 11:19:06 +0200
Commit message: Merge pull request from GHSA-6f4c-phfj-m255

* Pin components

* Bump components
Diff: diff --git a/Cartfile.resolved b/Cartfile.resolved
index 736e4c007..94ece6993 100644
--- a/Cartfile.resolved
+++ b/Cartfile.resolved
@@ -20,11 +20,11 @@ github "wireapp/wire-ios-data-model" "261.0.0"
 github "wireapp/wire-ios-images" "35.0.4"
 github "wireapp/wire-ios-link-preview" "31.0.4"
 github "wireapp/wire-ios-protos" "28.0.1"
 github "wireapp/wire-ios-request-strategy" "237.0.0"
 github "wireapp/wire-ios-share-engine" "222.0.0"
-github "wireapp/wire-ios-sync-engine" "385.0.0"
+github "wireapp/wire-ios-sync-engine" "385.0.1"
+github "wireapp/wire-ios-transport" "77.1.0"
 github "wireapp/wire-ios-system" "34.1.1"
 github "wireapp/wire-ios-testing" "25.1.1"
-github "wireapp/wire-ios-transport" "77.0.4"
 github "wireapp/wire-ios-utilities" "41.0.6"
 github "wireapp/wire-ios-ziphy" "16.0.3"

Vulnerable code: github "wireapp/wire-ios-sync-engine" "385.0.0"
github "wireapp/wire-ios-transport" "77.0.4"
Fixed code: github "wireapp/wire-ios-sync-engine" "385.0.1"
github "wireapp/wire-ios-transport" "77.1.0"
CVE-2024-0241: Allocation of Resources Without Limits or Throttling (CWE-770)
value: encoded_id-rails versions before 1.0.0.beta2 are affected by an uncontrolled resource consumption vulnerability. A remote and unauthenticated attacker might cause a denial of service condition by sending an HTTP request with an extremely long "id" parameter.


CWE description: The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
CVSS v3 base score: 7.5
Published: 2024-01-04T21:15Z
Repository: https://github.com/stevegeek/encoded_id-rails
Language: Other
Files changed: encoded_id-rails.gemspec
Commit date: 2023-10-23 08:14:04 +0300
Commit message: Update encoded_id dependency to address GHSA-3px7-jm2p-6h2c

Diff: diff --git a/encoded_id-rails.gemspec b/encoded_id-rails.gemspec
index 753d295..e6c3fa4 100644
--- a/encoded_id-rails.gemspec
+++ b/encoded_id-rails.gemspec
@@ -30,10 +30,10 @@ Gem::Specification.new do |spec|
   spec.require_paths = ["lib"]
 
   # Uncomment to register a new dependency of your gem
   spec.add_dependency "activesupport", ">= 6.0", "< 8.0"
   spec.add_dependency "activerecord", ">= 6.0", "< 8.0"
-  spec.add_dependency "encoded_id", "~> 1.0.0.rc2"
+  spec.add_dependency "encoded_id", "~> 1.0.0.rc3"
 
   # For more information and examples about making a new gem, check out our
   # guide at: https://bundler.io/guides/creating_gem.html
 end

Vulnerable code:   spec.add_dependency "encoded_id", "~> 1.0.0.rc2"
Fixed code:   spec.add_dependency "encoded_id", "~> 1.0.0.rc3"
CVE-2021-25994: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)
value: In Userfrosting, versions v0.3.1 to v4.6.2 are vulnerable to Host Header Injection. By luring a victim application user to click on a link, an unauthenticated attacker can use the “forgot password” functionality to reset the victim’s password and successfully take over their account.
CWE description: The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
CVSS v3 base score: 8.8
Published: 2022-01-03T07:15Z
Repository: https://github.com/userfrosting/UserFrosting
Language: PHP
Files changed: CHANGELOG.md, app/sprinkles/core/config/production.php
Commit date: 2021-12-12 12:22:58 +1100
Commit message: Placeholder for `site.uri.public` in production

Diff: diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3f99d825..677b9a78 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,10 +3,15 @@
 All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/)
 and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.html).
 
+## Unreleased
+
+### Security
+- Added placeholder URL for `site.uri.public` in configuration to guard against Host Header Injection attacks by default in production.
+
 ## [v4.6.2]
 
 ### Changes
 - Updated Portuguese translation ([#1178](https://github.com/userfrosting/UserFrosting/pull/1178)).
 
diff --git a/app/sprinkles/core/config/production.php b/app/sprinkles/core/config/production.php
index 6c57a675..8272211e 100644
--- a/app/sprinkles/core/config/production.php
+++ b/app/sprinkles/core/config/production.php
@@ -50,10 +50,13 @@ return [
         ],
         'debug' => [
             'ajax' => false,
             'info' => false,
         ],
+        'uri' => [
+            'public' => 'https://example.com',
+        ],
     ],
     /*
      * Send errors to log
      */
     'php' => [

Fixed code: ## Unreleased

### Security
- Added placeholder URL for `site.uri.public` in configuration to guard against Host Header Injection attacks by default in production.

        'uri' => [
            'public' => 'https://example.com',
        ],
CVE-2019-25073: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: Improper path sanitization in github.com/goadesign/goa before v3.0.9, v2.0.10, or v1.4.3 allow remote attackers to read files outside of the intended directory.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 7.5
Published: 2022-12-27T22:15Z
Repository: https://github.com/goadesign/goa
Language: Go
Files changed: service.go
Commit date: 2019-12-04 14:34:09 -0800
Commit message: v1: Prevent directory path traversal in FileHandler (#2388)

* Add check for attempted path traversal.

* Re-work check for attempted path traversal.

* Fix linting errors.

Diff: diff --git a/service.go b/service.go
index 291d7f6..e61950c 100644
--- a/service.go
+++ b/service.go
@@ -370,10 +370,14 @@ func (ctrl *Controller) FileHandler(path, filename string) Handler {
 		if strings.Contains(wc, "/") {
 			wc = ""
 		}
 	}
 	return func(ctx context.Context, rw http.ResponseWriter, req *http.Request) error {
+		// prevent path traversal
+		if attemptsPathTraversal(req.URL.Path, path) {
+			return ErrNotFound(req.URL.Path)
+		}
 		fname := filename
 		if len(wc) > 0 {
 			if m, ok := ContextRequest(ctx).Params[wc]; ok {
 				fname = filepath.Join(filename, m[0])
 			}
@@ -413,10 +417,36 @@ func (ctrl *Controller) FileHandler(path, filename string) Handler {
 		http.ServeContent(rw, req, d.Name(), d.ModTime(), f)
 		return nil
 	}
 }
 
+func attemptsPathTraversal(req string, path string) bool {
+	if !strings.Contains(req, "..") {
+		return false
+	}
+
+	currentPathIdx := 0
+	if idx := strings.LastIndex(path, "/*"); idx > -1 && idx < len(path)-1 {
+		req = req[idx+1:]
+	}
+	for _, runeValue := range strings.FieldsFunc(req, isSlashRune) {
+		if runeValue == ".." {
+			currentPathIdx--
+			if currentPathIdx < 0 {
+				return true
+			}
+		} else {
+			currentPathIdx++
+		}
+	}
+	return false
+}
+
+func isSlashRune(r rune) bool {
+	return os.IsPathSeparator(uint8(r))
+}
+
 var replacer = strings.NewReplacer(
 	"&", "&amp;",
 	"<", "&lt;",
 	">", "&gt;",
 	// "&#34;" is shorter than "&quot;".

Fixed code: 		// prevent path traversal
		if attemptsPathTraversal(req.URL.Path, path) {
			return ErrNotFound(req.URL.Path)
		}
func attemptsPathTraversal(req string, path string) bool {
	if !strings.Contains(req, "..") {
		return false
	}

	currentPathIdx := 0
	if idx := strings.LastIndex(path, "/*"); idx > -1 && idx < len(path)-1 {
		req = req[idx+1:]
	}
	for _, runeValue := range strings.FieldsFunc(req, isSlashRune) {
		if runeValue == ".." {
			currentPathIdx--
			if currentPathIdx < 0 {
				return true
			}
		} else {
			currentPathIdx++
		}
	}
	return false
}

func isSlashRune(r rune) bool {
	return os.IsPathSeparator(uint8(r))
}
CVE-2022-29161: Inadequate Encryption Strength (CWE-326)
value: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The XWiki Crypto API will generate X509 certificates signed by default using SHA1 with RSA, which is not considered safe anymore for use in certificate signatures, due to the risk of collisions with SHA1. The problem has been patched in XWiki version 13.10.6, 14.3.1 and 14.4-rc-1. Since then, the Crypto API will generate X509 certificates signed by default using SHA256 with RSA. Administrators are advised to upgrade their XWiki installation to one of the patched versions. If the upgrade is not possible, it is possible to patch the module xwiki-platform-crypto in a local installation by applying the change exposed in 26728f3 and re-compiling the module.
CWE description: The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.
CVSS v3 base score: 9.8
Published: 2022-05-06T00:15Z
Repository: https://github.com/xwiki/xwiki-platform
Language: Java
Files changed: xwiki-platform-core/xwiki-platform-crypto/xwiki-platform-crypto-script/src/main/java/org/xwiki/crypto/script/RSACryptoScriptService.java
Commit date: 2022-04-30 12:13:25 +0200
Commit message: XWIKI-19676: Update the RSA Crypto script service to use SHA256 instead of SHA1 for certificate signature

Diff: diff --git a/xwiki-platform-core/xwiki-platform-crypto/xwiki-platform-crypto-script/src/main/java/org/xwiki/crypto/script/RSACryptoScriptService.java b/xwiki-platform-core/xwiki-platform-crypto/xwiki-platform-crypto-script/src/main/java/org/xwiki/crypto/script/RSACryptoScriptService.java
index c9b2600834d3..879616f3005d 100644
--- a/xwiki-platform-core/xwiki-platform-crypto/xwiki-platform-crypto-script/src/main/java/org/xwiki/crypto/script/RSACryptoScriptService.java
+++ b/xwiki-platform-core/xwiki-platform-crypto/xwiki-platform-crypto-script/src/main/java/org/xwiki/crypto/script/RSACryptoScriptService.java
@@ -84,11 +84,11 @@ public class RSACryptoScriptService implements ScriptService
     @Inject
     @Named("RSA")
     private KeyPairGenerator keyPairGenerator;
 
     @Inject
-    @Named("SHA1withRSAEncryption")
+    @Named("SHA256withRSAEncryption")
     private SignerFactory signerFactory;
 
     @Inject
     private Provider<X509ExtensionBuilder> extensionBuilder;
 

Vulnerable code:     @Named("SHA1withRSAEncryption")
Fixed code:     @Named("SHA256withRSAEncryption")
CVE-2022-29251: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: XWiki Platform Flamingo Theme UI is a tool that allows customization and preview of any Flamingo-based skin. Starting with versions 6.2.4 and 6.3-rc-1, a possible cross-site scripting vector is present in the `FlamingoThemesCode.WebHomeSheet` wiki page related to the "newThemeName" form field. The issue is patched in versions 12.10.11, 14.0-rc-1, 13.4.7, and 13.10.3. The easiest available workaround is to edit the wiki page `FlamingoThemesCode.WebHomeSheet` (with wiki editor) according to the suggestion provided in the GitHub Security Advisory.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-05-25T21:15Z
Repository: https://github.com/xwiki/xwiki-platform
Language: XML
Files changed: xwiki-platform-core/xwiki-platform-flamingo/xwiki-platform-flamingo-theme/xwiki-platform-flamingo-theme-ui/src/main/resources/FlamingoThemesCode/WebHomeSheet.xml
Commit date: 2022-01-04 11:36:02 +0100
Commit message: XWIKI-19294: Fix bad escaping

Diff: diff --git a/xwiki-platform-core/xwiki-platform-flamingo/xwiki-platform-flamingo-theme/xwiki-platform-flamingo-theme-ui/src/main/resources/FlamingoThemesCode/WebHomeSheet.xml b/xwiki-platform-core/xwiki-platform-flamingo/xwiki-platform-flamingo-theme/xwiki-platform-flamingo-theme-ui/src/main/resources/FlamingoThemesCode/WebHomeSheet.xml
index a71814ef07ef..4fba502601ab 100644
--- a/xwiki-platform-core/xwiki-platform-flamingo/xwiki-platform-flamingo-theme/xwiki-platform-flamingo-theme-ui/src/main/resources/FlamingoThemesCode/WebHomeSheet.xml
+++ b/xwiki-platform-core/xwiki-platform-flamingo/xwiki-platform-flamingo-theme/xwiki-platform-flamingo-theme-ui/src/main/resources/FlamingoThemesCode/WebHomeSheet.xml
@@ -285,11 +285,11 @@
     
     {{html}}
       &lt;form action="$doc.getURL()" method="post"&gt;
         &lt;input type="hidden" name="form_token" value="$services.csrf.token" /&gt;
         &lt;input type="hidden" name="action" value="create"/&gt;
-        &lt;input type="hidden" name="newThemeName" id="newThemeName" value="$request.newThemeName" /&gt;
+        &lt;input type="hidden" name="newThemeName" id="newThemeName" value="$escapetool.xml($request.newThemeName)" /&gt;
         &lt;input type="submit" value="$services.localization.render('platform.flamingo.themes.home.create.confirm')" class="button"/&gt;
       &lt;/form&gt;
     {{/html}}
   #else
     ## Let's do it

Vulnerable code:         &lt;input type="hidden" name="newThemeName" id="newThemeName" value="$request.newThemeName" /&gt;
Fixed code:         &lt;input type="hidden" name="newThemeName" id="newThemeName" value="$escapetool.xml($request.newThemeName)" /&gt;
CVE-2022-29252: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: XWiki Platform Wiki UI Main Wiki is a package for managing subwikis. Starting with version 5.3-milestone-2, XWiki Platform Wiki UI Main Wiki contains a possible cross-site scripting vector in the `WikiManager.JoinWiki ` wiki page related to the "requestJoin" field. The issue is patched in versions 12.10.11, 14.0-rc-1, 13.4.7, and 13.10.3. The easiest available workaround is to edit the wiki page `WikiManager.JoinWiki` (with wiki editor) according to the suggestion provided in the GitHub Security Advisory.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-05-25T21:15Z
Repository: https://github.com/xwiki/xwiki-platform
Language: XML
Files changed: xwiki-platform-core/xwiki-platform-wiki/xwiki-platform-wiki-ui/xwiki-platform-wiki-ui-mainwiki/src/main/resources/WikiManager/JoinWiki.xml
Commit date: 2022-01-04 11:36:02 +0100
Commit message: XWIKI-19292: Fix bad escaping

Diff: diff --git a/xwiki-platform-core/xwiki-platform-wiki/xwiki-platform-wiki-ui/xwiki-platform-wiki-ui-mainwiki/src/main/resources/WikiManager/JoinWiki.xml b/xwiki-platform-core/xwiki-platform-wiki/xwiki-platform-wiki-ui/xwiki-platform-wiki-ui-mainwiki/src/main/resources/WikiManager/JoinWiki.xml
index ca408851faa3..3a717b2100c4 100644
--- a/xwiki-platform-core/xwiki-platform-wiki/xwiki-platform-wiki-ui/xwiki-platform-wiki-ui-mainwiki/src/main/resources/WikiManager/JoinWiki.xml
+++ b/xwiki-platform-core/xwiki-platform-wiki/xwiki-platform-wiki-ui/xwiki-platform-wiki-ui-mainwiki/src/main/resources/WikiManager/JoinWiki.xml
@@ -243,11 +243,11 @@
                   &lt;br/&gt;
                   &lt;input type='submit' name='submit' value="$services.localization.render('platform.wiki.users.join.request.send.label')" class='button'/&gt;
                   &lt;a href="$backUrl" class='button secondary'&gt;{{translation key="platform.wiki.users.join.request.cancel.label"/}}&lt;/a&gt;
                 &lt;/span&gt;
                 &lt;input type='hidden' name='wikiId' value="$!wikiId"/&gt;
-                &lt;input type='hidden' name='requestJoin' value="$!request.requestJoin"/&gt;
+                &lt;input type='hidden' name='requestJoin' value="$escapetool.xml($!request.requestJoin)"/&gt;
                 &lt;input type="hidden" name="form_token" value="$!escapetool.xml($services.csrf.getToken())" /&gt;
               &lt;/dl&gt;
             &lt;/form&gt;
           {{/html}}
         #else

Vulnerable code:                 &lt;input type='hidden' name='requestJoin' value="$!request.requestJoin"/&gt;
Fixed code:                 &lt;input type='hidden' name='requestJoin' value="$escapetool.xml($!request.requestJoin)"/&gt;
CVE-2022-36098: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: XWiki Platform Mentions UI is a user interface for mentioning users in wiki content for XWiki Platform, a generic wiki platform. Starting in version 12.5-rc-1 and prior to versions 13.10.6 and 14.4, it's possible to store Javascript or groovy scripts in a mention, macro anchor, or reference field. The stored code is executed by anyone visiting the page with the mention. This issue has been patched on XWiki 14.4 and 13.10.6. As a workaround, one may update `XWiki.Mentions.MentionsMacro` and edit the `Macro code` field of the `XWiki.WikiMacroClass` XObject.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 9
Published: 2022-09-08T21:15Z
Repository: https://github.com/xwiki/xwiki-platform
Language: XML
Files changed: xwiki-platform-core/xwiki-platform-mentions/xwiki-platform-mentions-ui/src/main/resources/XWiki/Mentions/MentionsMacro.xml
Commit date: 2022-05-20 18:06:30 +0200
Commit message: XWIKI-19752: Improved mentions macro escaping

Diff: diff --git a/xwiki-platform-core/xwiki-platform-mentions/xwiki-platform-mentions-ui/src/main/resources/XWiki/Mentions/MentionsMacro.xml b/xwiki-platform-core/xwiki-platform-mentions/xwiki-platform-mentions-ui/src/main/resources/XWiki/Mentions/MentionsMacro.xml
index 944514076fac..d5f034587cba 100644
--- a/xwiki-platform-core/xwiki-platform-mentions/xwiki-platform-mentions-ui/src/main/resources/XWiki/Mentions/MentionsMacro.xml
+++ b/xwiki-platform-core/xwiki-platform-mentions/xwiki-platform-mentions-ui/src/main/resources/XWiki/Mentions/MentionsMacro.xml
@@ -602,11 +602,13 @@
 #if ($isCurrentUser)
   #set ($discard = $cssClasses.add('self'))
 #end
 #set ($link = $xwiki.getURL($reference.reference, 'view'))
 {{html}}
-&lt;a id="$anchor" class="$stringtool.join($cssClasses, ' ')" data-reference="$services.model.serialize($reference.reference, 'default')" href="$link"&gt;$content&lt;/a&gt;
+&lt;a id="$escapetool.xml($anchor)" class="$stringtool.join($cssClasses, ' ')" data-reference="$escapetool.xml($services.model.serialize($reference.reference, 'default'))" href="$escapetool.xml($link)"&gt;
+  $escapetool.xml($content)
+&lt;/a&gt;
 {{/html}}
 {{/velocity}}</code>
     </property>
     <property>
       <contentDescription/>

Vulnerable code: &lt;a id="$anchor" class="$stringtool.join($cssClasses, ' ')" data-reference="$services.model.serialize($reference.reference, 'default')" href="$link"&gt;$content&lt;/a&gt;
Fixed code: &lt;a id="$escapetool.xml($anchor)" class="$stringtool.join($cssClasses, ' ')" data-reference="$escapetool.xml($services.model.serialize($reference.reference, 'default'))" href="$escapetool.xml($link)"&gt;
  $escapetool.xml($content)
&lt;/a&gt;
CVE-2022-41929: Missing Authorization (CWE-862)
value: org.xwiki.platform:xwiki-platform-oldcore is missing authorization in User#setDisabledStatus, which may allow an incorrectly authorized user with only Script rights to enable or disable a user. This operation is meant to only be available for users with admin rights. This problem has been patched in XWiki 13.10.7, 14.4.2 and 14.5RC1.
CWE description: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CVSS v3 base score: 4.9
Published: 2022-11-23T19:15Z
Repository: https://github.com/xwiki/xwiki-platform
Language: Java
Files changed: xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/api/User.java
Commit date: 2022-06-09 14:40:38 +0200
Commit message: XWIKI-19804: Bulletproof user API

Diff: diff --git a/xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/api/User.java b/xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/api/User.java
index c2f55f1b19af..c81b109e4c94 100644
--- a/xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/api/User.java
+++ b/xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/api/User.java
@@ -90,11 +90,13 @@ public XWikiUser getUser()
      * @param disabledStatus true to disable an user, false to enable it back.
      * @since 11.7RC1
      */
     public void setDisabledStatus(boolean disabledStatus)
     {
-        this.user.setDisabled(disabledStatus, getXWikiContext());
+        if (hasAdminRights()) {
+            this.user.setDisabled(disabledStatus, getXWikiContext());
+        }
     }
 
     /**
      * @return {@code true} if the user is disabled, false if it is enabled.
      * @since 11.8RC1

Vulnerable code:         this.user.setDisabled(disabledStatus, getXWikiContext());
Fixed code:         if (hasAdminRights()) {
            this.user.setDisabled(disabledStatus, getXWikiContext());
        }
CVE-2022-41931: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') (CWE-95)
value: xwiki-platform-icon-ui is vulnerable to Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection'). Any user with view rights on commonly accessible documents including the icon picker macro can execute arbitrary Groovy, Python or Velocity code in XWiki due to improper neutralization of the macro parameters of the icon picker macro. The problem has been patched in XWiki 13.10.7, 14.5 and 14.4.2. Workarounds: The [patch](https://github.com/xwiki/xwiki-platform/commit/47eb8a5fba550f477944eb6da8ca91b87eaf1d01) can be manually applied by editing `IconThemesCode.IconPickerMacro` in the object editor. The whole document can also be replaced by the current version by importing the document from the XAR archive of a fixed version as the only changes to the document have been security fixes and small formatting changes.
CWE description: The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").
CVSS v3 base score: 8.8
Published: 2022-11-23T20:15Z
Repository: https://github.com/xwiki/xwiki-platform
Language: XML
Files changed: xwiki-platform-core/xwiki-platform-icon/xwiki-platform-icon-ui/src/main/resources/IconThemesCode/IconPickerMacro.xml
Commit date: 2022-06-09 15:55:49 +0200
Commit message: XWIKI-19805: Improve parameter escaping in IconPickerMacro

Diff: diff --git a/xwiki-platform-core/xwiki-platform-icon/xwiki-platform-icon-ui/src/main/resources/IconThemesCode/IconPickerMacro.xml b/xwiki-platform-core/xwiki-platform-icon/xwiki-platform-icon-ui/src/main/resources/IconThemesCode/IconPickerMacro.xml
index 202a4d45593e..84a1dfda648c 100644
--- a/xwiki-platform-core/xwiki-platform-icon/xwiki-platform-icon-ui/src/main/resources/IconThemesCode/IconPickerMacro.xml
+++ b/xwiki-platform-core/xwiki-platform-icon/xwiki-platform-icon-ui/src/main/resources/IconThemesCode/IconPickerMacro.xml
@@ -198,14 +198,14 @@
     var options = {};
     #if($xcontext.macro.params.parameterNames.contains('prefix'))
       options['prefix'] = '$escapetool.javascript($xcontext.macro.params.prefix)';
     #end
     #if("$!xcontext.macro.params.id" != '')
-      $('#${xcontext.macro.params.id}').xwikiIconPicker(options);
+      $('#${escapetool.javascript(${xcontext.macro.params.id})}').xwikiIconPicker(options);
     #end
     #if("$!xcontext.macro.params.get('class')" != '')
-      $('.${xcontext.macro.params.get('class')}').xwikiIconPicker(options);
+      $('.${escapetool.javascript(${xcontext.macro.params.get('class')})}').xwikiIconPicker(options);
     #end
   });
 &lt;/script&gt;
 {{/html}}
 {{/velocity}}</code>

Vulnerable code:       $('#${xcontext.macro.params.id}').xwikiIconPicker(options);
      $('.${xcontext.macro.params.get('class')}').xwikiIconPicker(options);
Fixed code:       $('#${escapetool.javascript(${xcontext.macro.params.id})}').xwikiIconPicker(options);
      $('.${escapetool.javascript(${xcontext.macro.params.get('class')})}').xwikiIconPicker(options);
CVE-2023-26470: Out-of-bounds Write (CWE-787)
value: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to make the farm unusable by adding an object to a page with a huge number (e.g. 67108863). Most of the time this will fill the memory allocated to XWiki and make it unusable every time this document is manipulated. This issue has been patched in XWiki 14.0-rc-1.

CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.5
Published: 2023-03-02T19:15Z
Repository: https://github.com/xwiki/xwiki-platform
Language: XML
Files changed: xwiki-platform-core/xwiki-platform-oldcore/pom.xml
Commit date: 2022-01-05 16:48:44 +0100
Commit message: XWIKI-19223: Saving a document with a large object number leads to persistent OOM errors

Diff: diff --git a/xwiki-platform-core/xwiki-platform-oldcore/pom.xml b/xwiki-platform-core/xwiki-platform-oldcore/pom.xml
index e771d6ca29ea..945349e80007 100644
--- a/xwiki-platform-core/xwiki-platform-oldcore/pom.xml
+++ b/xwiki-platform-core/xwiki-platform-oldcore/pom.xml
@@ -608,10 +608,11 @@
       <scope>test</scope>
     </dependency>
     <dependency>
       <groupId>com.google.guava</groupId>
       <artifactId>guava-testlib</artifactId>
+      <scope>test</scope>
     </dependency>
 
     <dependency>
       <groupId>org.xwiki.commons</groupId>
       <artifactId>xwiki-commons-tool-test-component</artifactId>

Fixed code:       <scope>test</scope>
CVE-2023-26475: Improper Privilege Management (CWE-269)
value: XWiki Platform is a generic wiki platform. Starting in version 2.3-milestone-1, the annotation displayer does not execute the content in a restricted context. This allows executing anything with the right of the author of any document by annotating the document. This has been patched in XWiki 13.10.11, 14.4.7 and 14.10. There is no easy workaround except to upgrade.
CWE description: The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
CVSS v3 base score: 8.8
Published: 2023-03-02T19:15Z
Repository: https://github.com/xwiki/xwiki-platform
Language: Java
Files changed: xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/internal/mandatory/XWikiCommentsDocumentInitializer.java
Commit date: 2022-11-18 15:35:04 +0100
Commit message: XWIKI-20384: Use the new textarea restricted setup in comments

Diff: diff --git a/xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/internal/mandatory/XWikiCommentsDocumentInitializer.java b/xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/internal/mandatory/XWikiCommentsDocumentInitializer.java
index a9c0e86612a7b..986f54734d0c5 100644
--- a/xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/internal/mandatory/XWikiCommentsDocumentInitializer.java
+++ b/xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/internal/mandatory/XWikiCommentsDocumentInitializer.java
@@ -85,11 +85,11 @@ protected void createClass(BaseClass xclass)
 
         xclass.addTextAreaField("highlight", "Highlighted Text", 40, 2);
         xclass.addNumberField("replyto", "Reply To", 5, "integer");
 
         String commentPropertyName = "comment";
-        xclass.addTextAreaField(commentPropertyName, "Comment", 40, 5);
+        xclass.addTextAreaField(commentPropertyName, "Comment", 40, 5, true);
 
         // FIXME: Ensure that the comment text editor is set to its default value after an upgrade. This should be
         // handled in a cleaner way in BaseClass#addTextAreaField. See: https://jira.xwiki.org/browse/XWIKI-17605
         TextAreaClass comment =  (TextAreaClass) xclass.getField(commentPropertyName);
         comment.setEditor((String) null);

Vulnerable code:         xclass.addTextAreaField(commentPropertyName, "Comment", 40, 5);
Fixed code:         xclass.addTextAreaField(commentPropertyName, "Comment", 40, 5, true);
CVE-2023-26480: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: XWiki Platform is a generic wiki platform. Starting in version 12.10, a user without script rights can introduce a stored cross-site scripting by using the Live Data macro. This has been patched in XWiki 14.9, 14.4.7, and 13.10.10. There are no known workarounds.

CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-03-02T18:15Z
Repository: https://github.com/xwiki/xwiki-platform
Language: Java
Files changed: xwiki-platform-core/xwiki-platform-livedata/xwiki-platform-livedata-macro/src/test/java/org/xwiki/livedata/internal/macro/LiveDataMacroComponentList.java
Commit date: 2022-10-20 17:10:36 +0200
Commit message: XWIKI-20143: Improved Live Data escaping

Add missing components in LiveDataMacroComponentList.

Diff: diff --git a/xwiki-platform-core/xwiki-platform-livedata/xwiki-platform-livedata-macro/src/test/java/org/xwiki/livedata/internal/macro/LiveDataMacroComponentList.java b/xwiki-platform-core/xwiki-platform-livedata/xwiki-platform-livedata-macro/src/test/java/org/xwiki/livedata/internal/macro/LiveDataMacroComponentList.java
index edff3dfd8fd89..1f2fdca95561c 100644
--- a/xwiki-platform-core/xwiki-platform-livedata/xwiki-platform-livedata-macro/src/test/java/org/xwiki/livedata/internal/macro/LiveDataMacroComponentList.java
+++ b/xwiki-platform-core/xwiki-platform-livedata/xwiki-platform-livedata-macro/src/test/java/org/xwiki/livedata/internal/macro/LiveDataMacroComponentList.java
@@ -47,11 +47,13 @@
 @Target({ TYPE, METHOD, ANNOTATION_TYPE })
 @ComponentList({
     LiveDataMacro.class,
     DefaultLiveDataConfigurationResolver.class,
     StringLiveDataConfigurationResolver.class,
-    JsFileSkinExtension.class
+    JsFileSkinExtension.class,
+    LiveDataMacroConfiguration.class,
+    LiveDataMacroRights.class
 })
 @Inherited
 public @interface LiveDataMacroComponentList
 {
 }

Vulnerable code:     JsFileSkinExtension.class
Fixed code:     JsFileSkinExtension.class,
    LiveDataMacroConfiguration.class,
    LiveDataMacroRights.class
CVE-2023-32069: Incorrect Authorization (CWE-863)
value: XWiki Platform is a generic wiki platform. Starting in version 3.3-milestone-2 and prior to versions 14.10.4 and 15.0-rc-1, it's possible for a user to execute anything with the right of the author of the XWiki.ClassSheet document. This has been patched in XWiki 15.0-rc-1 and 14.10.4. There are no known workarounds.
CWE description: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
CVSS v3 base score: 8.8
Published: 2023-05-09T16:15Z
Repository: https://github.com/xwiki/xwiki-platform
Language: XML
Files changed: xwiki-platform-core/xwiki-platform-xclass/xwiki-platform-xclass-ui/src/main/resources/XWiki/ClassSheet.xml
Commit date: 2023-01-19 10:33:11 +0100
Commit message: XWIKI-20566: Improve Class Sheet display

Diff: diff --git a/xwiki-platform-core/xwiki-platform-xclass/xwiki-platform-xclass-ui/src/main/resources/XWiki/ClassSheet.xml b/xwiki-platform-core/xwiki-platform-xclass/xwiki-platform-xclass-ui/src/main/resources/XWiki/ClassSheet.xml
index 5e7ef3f27512e..8b2233b1ad959 100644
--- a/xwiki-platform-core/xwiki-platform-xclass/xwiki-platform-xclass-ui/src/main/resources/XWiki/ClassSheet.xml
+++ b/xwiki-platform-core/xwiki-platform-xclass/xwiki-platform-xclass-ui/src/main/resources/XWiki/ClassSheet.xml
@@ -81,11 +81,11 @@
 {{velocity}}
 ## If this sheet is explicitly bound to the displayed class then print the class document content before the
 ## sheet output. Class authors can put the description of the class in the class document content.
 #set($classSheetReference = $services.model.createDocumentReference($doc.wiki, 'XWiki', 'ClassSheet'))
 #if($services.sheet.getDocumentSheets($doc).contains($classSheetReference))
-  {{include reference="" /}}
+  {{include reference="" author="target"/}}
 #end
 {{/velocity}}
 
 {{velocity}}
 #if (!$isSheet)

Vulnerable code:   {{include reference="" /}}
Fixed code:   {{include reference="" author="target"/}}
CVE-2023-32071: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: XWiki Platform is a generic wiki platform. Starting in versions 2.2-milestone-1 and prior to versions 14.4.8, 14.10.4, and 15.0-rc-1, it's possible to execute javascript with the right of any user by leading him to a special URL on the wiki targeting a page which contains an attachment. This has been patched in XWiki 15.0-rc-1, 14.10.4, and 14.4.8. The easiest possible workaround is to edit file `<xwiki app>/templates/importinline.vm` and apply the modification described in commit 28905f7f518cc6f21ea61fe37e9e1ed97ef36f01.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 9
Published: 2023-05-09T16:15Z
Repository: https://github.com/xwiki/xwiki-platform
Language: Other
Files changed: xwiki-platform-core/xwiki-platform-web/xwiki-platform-web-templates/src/main/resources/templates/importinline.vm
Commit date: 2023-01-19 16:21:19 +0100
Commit message: XWIKI-20340: Improve import escaping

Diff: diff --git a/xwiki-platform-core/xwiki-platform-web/xwiki-platform-web-templates/src/main/resources/templates/importinline.vm b/xwiki-platform-core/xwiki-platform-web/xwiki-platform-web-templates/src/main/resources/templates/importinline.vm
index af84fdc711213..1b841e2e8759a 100644
--- a/xwiki-platform-core/xwiki-platform-web/xwiki-platform-web-templates/src/main/resources/templates/importinline.vm
+++ b/xwiki-platform-core/xwiki-platform-web/xwiki-platform-web-templates/src/main/resources/templates/importinline.vm
@@ -48,11 +48,11 @@
 ## ---------------------------------------------------------------------------
 ## Browse the XARs and let the user select a XAR and the list of documents
 ## to import from that XAR.
 ## ---------------------------------------------------------------------------
 #else
-  #set($baseQueryString = "editor=$!{request.editor}&amp;section=$!{request.section}")
+  #set($baseQueryString = "editor=$!{escapetool.url($request.editor)}&amp;section=$!{escapetool.url($request.section)}")
   $xwiki.jsfx.use('js/xwiki/importer/import.js', true)##
   $xwiki.ssfx.use('js/xwiki/importer/import.css', true)##
   $xwiki.jsfx.use('uicomponents/widgets/upload.js', {'forceSkinAction': true, 'language': ${xcontext.locale}})##
   $xwiki.ssfx.use('uicomponents/widgets/upload.css', true)##
   <div id="import" class="row">

Vulnerable code:   #set($baseQueryString = "editor=$!{request.editor}&amp;section=$!{request.section}")
Fixed code:   #set($baseQueryString = "editor=$!{escapetool.url($request.editor)}&amp;section=$!{escapetool.url($request.section)}")
CVE-2023-35156: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). It's possible to exploit the delete template to perform a XSS, e.g. by using URL such as: > xwiki/bin/get/FlamingoThemes/Cerulean?xpage=xpart&vm=delete.vm&xredirect=javascript:alert(document.domain). This vulnerability exists since XWiki 6.0-rc-1. The vulnerability has been patched in XWiki 14.10.6 and 15.1. Note that a partial patch has been provided in 14.10.5 but wasn't enough to entirely fix the vulnerability. 

CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-06-23T19:15Z
Repository: https://github.com/xwiki/xwiki-platform
Language: Other
Files changed: xwiki-platform-core/xwiki-platform-flamingo/xwiki-platform-flamingo-skin/xwiki-platform-flamingo-skin-resources/src/main/resources/flamingo/delete.vm
Commit date: 2023-02-22 09:46:27 +0100
Commit message: XWIKI-20672: Sanitize template URLs

Diff: diff --git a/xwiki-platform-core/xwiki-platform-flamingo/xwiki-platform-flamingo-skin/xwiki-platform-flamingo-skin-resources/src/main/resources/flamingo/delete.vm b/xwiki-platform-core/xwiki-platform-flamingo/xwiki-platform-flamingo-skin/xwiki-platform-flamingo-skin-resources/src/main/resources/flamingo/delete.vm
index c1a64fa272181..643526ed16905 100644
--- a/xwiki-platform-core/xwiki-platform-flamingo/xwiki-platform-flamingo-skin/xwiki-platform-flamingo-skin-resources/src/main/resources/flamingo/delete.vm
+++ b/xwiki-platform-core/xwiki-platform-flamingo/xwiki-platform-flamingo-skin/xwiki-platform-flamingo-skin-resources/src/main/resources/flamingo/delete.vm
@@ -305,13 +305,13 @@
       <input type="hidden" name="xredirect" value="$!{escapetool.xml($request.xredirect)}"/>
     #end
   </div>
   <button class="btn btn-danger confirm">$escapetool.xml($services.localization.render('delete'))</button>
   #if("$!{request.xredirect}" != '')
-    #set($cancelUrl = "$request.xredirect")
+    #getSanitizedURLAttributeValue('a','href',$request.xredirect,$doc.getURL(),$cancelUrl)
   #else
-    #set($cancelUrl = $doc.getURL())
+    #set($cancelUrl = $escapetool.xml($doc.getURL()))
   #end
   <a class="btn btn-default cancel" href="$!{escapetool.xml(${cancelUrl})}">$escapetool.xml($services.localization.render('cancel'))</a>
 #end
 #######################################################
 ##      DISPLAY DELETE COMPLETELY CONFIRM MESSAGE

Vulnerable code:     #set($cancelUrl = "$request.xredirect")
    #set($cancelUrl = $doc.getURL())
Fixed code:     #getSanitizedURLAttributeValue('a','href',$request.xredirect,$doc.getURL(),$cancelUrl)
    #set($cancelUrl = $escapetool.xml($doc.getURL()))
CVE-2023-35156: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). It's possible to exploit the delete template to perform a XSS, e.g. by using URL such as: > xwiki/bin/get/FlamingoThemes/Cerulean?xpage=xpart&vm=delete.vm&xredirect=javascript:alert(document.domain). This vulnerability exists since XWiki 6.0-rc-1. The vulnerability has been patched in XWiki 14.10.6 and 15.1. Note that a partial patch has been provided in 14.10.5 but wasn't enough to entirely fix the vulnerability. 

CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-06-23T19:15Z
Repository: https://github.com/xwiki/xwiki-platform
Language: Other
Files changed: xwiki-platform-core/xwiki-platform-flamingo/xwiki-platform-flamingo-skin/xwiki-platform-flamingo-skin-resources/src/main/resources/flamingo/delete.vm
Commit date: 2023-02-22 09:56:10 +0100
Commit message: XWIKI-20672: Sanitize template URLs

  * Fix mistake

Diff: diff --git a/xwiki-platform-core/xwiki-platform-flamingo/xwiki-platform-flamingo-skin/xwiki-platform-flamingo-skin-resources/src/main/resources/flamingo/delete.vm b/xwiki-platform-core/xwiki-platform-flamingo/xwiki-platform-flamingo-skin/xwiki-platform-flamingo-skin-resources/src/main/resources/flamingo/delete.vm
index 643526ed16905..3b219626aadd1 100644
--- a/xwiki-platform-core/xwiki-platform-flamingo/xwiki-platform-flamingo-skin/xwiki-platform-flamingo-skin-resources/src/main/resources/flamingo/delete.vm
+++ b/xwiki-platform-core/xwiki-platform-flamingo/xwiki-platform-flamingo-skin/xwiki-platform-flamingo-skin-resources/src/main/resources/flamingo/delete.vm
@@ -309,11 +309,11 @@
   #if("$!{request.xredirect}" != '')
     #getSanitizedURLAttributeValue('a','href',$request.xredirect,$doc.getURL(),$cancelUrl)
   #else
     #set($cancelUrl = $escapetool.xml($doc.getURL()))
   #end
-  <a class="btn btn-default cancel" href="$!{escapetool.xml(${cancelUrl})}">$escapetool.xml($services.localization.render('cancel'))</a>
+  <a class="btn btn-default cancel" href="${cancelUrl}">$escapetool.xml($services.localization.render('cancel'))</a>
 #end
 #######################################################
 ##      DISPLAY DELETE COMPLETELY CONFIRM MESSAGE
 ##
 ## Display a confirmation message when the user wants 

Vulnerable code:   <a class="btn btn-default cancel" href="$!{escapetool.xml(${cancelUrl})}">$escapetool.xml($services.localization.render('cancel'))</a>
Fixed code:   <a class="btn btn-default cancel" href="${cancelUrl}">$escapetool.xml($services.localization.render('cancel'))</a>
CVE-2023-35158: Improper Neutralization of Alternate XSS Syntax (CWE-87)
value: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). It's possible to exploit the restore template to perform a XSS, e.g. by using URL such as: > /xwiki/bin/view/XWiki/Main?xpage=restore&showBatch=true&xredirect=javascript:alert(document.domain). This vulnerability exists since XWiki 9.4-rc-1. The vulnerability has been patched in XWiki 14.10.5 and 15.1-rc-1. 
CWE description: The product does not neutralize or incorrectly neutralizes user-controlled input for alternate script syntax.
CVSS v3 base score: 6.1
Published: 2023-06-23T19:15Z
Repository: https://github.com/xwiki/xwiki-platform
Language: Other
Files changed: xwiki-platform-core/xwiki-platform-flamingo/xwiki-platform-flamingo-skin/xwiki-platform-flamingo-skin-resources/src/main/resources/flamingo/restore.vm
Commit date: 2023-02-02 18:56:55 +0100
Commit message: XWIKI-20352: Sanitize template URLs

Diff: diff --git a/xwiki-platform-core/xwiki-platform-flamingo/xwiki-platform-flamingo-skin/xwiki-platform-flamingo-skin-resources/src/main/resources/flamingo/restore.vm b/xwiki-platform-core/xwiki-platform-flamingo/xwiki-platform-flamingo-skin/xwiki-platform-flamingo-skin-resources/src/main/resources/flamingo/restore.vm
index 020d49fd8ec9d..117490d85340e 100644
--- a/xwiki-platform-core/xwiki-platform-flamingo/xwiki-platform-flamingo-skin/xwiki-platform-flamingo-skin-resources/src/main/resources/flamingo/restore.vm
+++ b/xwiki-platform-core/xwiki-platform-flamingo/xwiki-platform-flamingo-skin/xwiki-platform-flamingo-skin-resources/src/main/resources/flamingo/restore.vm
@@ -176,11 +176,11 @@
       <input type="hidden" name="xredirect" value="$!{escapetool.xml($request.xredirect)}"/>
     #end
   </div>
   <button class="btn btn-primary">$services.localization.render('core.restore.confirm.yes')</button>
   #if("$!{request.xredirect}" != '')
-    #set($cancelUrl = "$request.xredirect")
+    #getSanitizedURLAttributeValue('a','href',$request.xredirect,$doc.getURL(),$cancelUrl)
   #else
-    #set($cancelUrl = $doc.getURL())
+    #set($cancelUrl = $escapetool.xml($doc.getURL()))
   #end
-  <a class="btn btn-default" href="$!{escapetool.xml(${cancelUrl})}">$services.localization.render('core.restore.confirm.no')</a>
+  <a class="btn btn-default" href="$cancelUrl">$services.localization.render('core.restore.confirm.no')</a>
 #end

Vulnerable code:     #set($cancelUrl = "$request.xredirect")
    #set($cancelUrl = $doc.getURL())
  <a class="btn btn-default" href="$!{escapetool.xml(${cancelUrl})}">$services.localization.render('core.restore.confirm.no')</a>
Fixed code:     #getSanitizedURLAttributeValue('a','href',$request.xredirect,$doc.getURL(),$cancelUrl)
    #set($cancelUrl = $escapetool.xml($doc.getURL()))
  <a class="btn btn-default" href="$cancelUrl">$services.localization.render('core.restore.confirm.no')</a>
CVE-2023-35159: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). It's possible to exploit the deletespace template to perform a XSS, e.g. by using URL such as: > xwiki/bin/deletespace/Sandbox/?xredirect=javascript:alert(document.domain). This vulnerability exists since XWiki 3.4-milestone-1. The vulnerability has been patched in XWiki 14.10.5 and 15.1-rc-1.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-06-23T19:15Z
Repository: https://github.com/xwiki/xwiki-platform
Language: Other
Files changed: xwiki-platform-core/xwiki-platform-web/xwiki-platform-web-templates/src/main/resources/templates/deletespace.vm
Commit date: 2023-02-02 18:56:55 +0100
Commit message: XWIKI-20612: Sanitize template URLs

Diff: diff --git a/xwiki-platform-core/xwiki-platform-web/xwiki-platform-web-templates/src/main/resources/templates/deletespace.vm b/xwiki-platform-core/xwiki-platform-web/xwiki-platform-web-templates/src/main/resources/templates/deletespace.vm
index 31e4367134cf7..653d8434abd55 100644
--- a/xwiki-platform-core/xwiki-platform-web/xwiki-platform-web-templates/src/main/resources/templates/deletespace.vm
+++ b/xwiki-platform-core/xwiki-platform-web/xwiki-platform-web-templates/src/main/resources/templates/deletespace.vm
@@ -27,12 +27,13 @@
     #if ($message)
       <div id="xwikimessage">$message</div>
     #end
     #set ($cancelURL = $doc.getURL())
     #if ($request.xredirect)
+      ## We don't sanitize this as it will be handled by the server
       #set ($redirectparam = "&amp;xredirect=$escapetool.url($request.xredirect)")
-      #set ($cancelURL = $request.xredirect)
+      #getSanitizedURLAttributeValue('a','href',$request.xredirect,$doc.getURL(),$cancelURL)
     #end
     #if ($xwiki.hasRecycleBin())
       #set ($confirmationMessage = $services.localization.render('core.space.recyclebin.confirm', ["<em>${escapetool.xml($doc.space)}</em>"]))
     #else
       #set ($confirmationMessage = $services.localization.render('core.space.delete.confirm', ["<em>${escapetool.xml($doc.space)}</em>"]))

Vulnerable code:       #set ($cancelURL = $request.xredirect)
Fixed code:       ## We don't sanitize this as it will be handled by the server
      #getSanitizedURLAttributeValue('a','href',$request.xredirect,$doc.getURL(),$cancelURL)