deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-12502
Published: 2020-10-15
Description: Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE, ES9528/ES9528-XT (all versions) and ICRL-M-8RJ45/4SFP-G-DIN, ICRL-M-16RJ45/4CP-G-DIN FW 1.2.3 and below is prone to unauthenticated device administration.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: http://packetstormsecurity.com/files/162903/Korenix-CSRF-Backdoor-Accounts-Command-Injection-Missing-Authentication.html; http://packetstormsecurity.com/files/165875/Korenix-Technology-JetWave-CSRF-Command-Injection-Missing-Authentication.html; http://seclists.org/fulldisclosure/2021/Jun/0
CVE: CVE-2020-12503
Published: 2020-10-15
Description: Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE, ES9528/ES9528-XT (all versions) and ICRL-M-8RJ45/4SFP-G-DIN, ICRL-M-16RJ45/4CP-G-DIN FW 1.2.3 and below is prone to multiple authenticated command injections.
CVSS Score: 7.2 (HIGH)
CWE: CWE-863, CWE-863
References: http://packetstormsecurity.com/files/162903/Korenix-CSRF-Backdoor-Accounts-Command-Injection-Missing-Authentication.html; http://packetstormsecurity.com/files/165875/Korenix-Technology-JetWave-CSRF-Command-Injection-Missing-Authentication.html; http://seclists.org/fulldisclosure/2021/Jun/0
CVE: CVE-2020-12504
Published: 2020-10-15
Description: Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE, ES9528/ES9528-XT (all versions) and ICRL-M-8RJ45/4SFP-G-DIN, ICRL-M-16RJ45/4CP-G-DIN FW 1.2.3 and below has an active TFTP-Service.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-912
References: http://packetstormsecurity.com/files/162903/Korenix-CSRF-Backdoor-Accounts-Command-Injection-Missing-Authentication.html; http://packetstormsecurity.com/files/165875/Korenix-Technology-JetWave-CSRF-Command-Injection-Missing-Authentication.html; http://seclists.org/fulldisclosure/2021/Jun/0
CVE: CVE-2020-15792
Published: 2020-10-15
Description: A vulnerability has been identified in Desigo Insight (All versions). The web service does not properly apply input validation for some query parameters in a reserved area. This could allow an authenticated attacker to retrieve data via a content-based blind SQL injection attack.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-89
References: https://cert-portal.siemens.com/productcert/pdf/ssa-226339.pdf; https://us-cert.cisa.gov/ics/advisories/icsa-20-287-05; https://cert-portal.siemens.com/productcert/pdf/ssa-226339.pdf
CVE: CVE-2020-15793
Published: 2020-10-15
Description: A vulnerability has been identified in Desigo Insight (All versions). The device does not properly set the X-Frame-Options HTTP Header which makes it vulnerable to Clickjacking attacks. This could allow an unauthenticated attacker to retrieve or modify data in the context of a legitimate user by tricking that user to click on a website controlled by the attacker.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-1021
References: https://cert-portal.siemens.com/productcert/pdf/ssa-226339.pdf; https://us-cert.cisa.gov/ics/advisories/icsa-20-287-05; https://cert-portal.siemens.com/productcert/pdf/ssa-226339.pdf
CVE: CVE-2020-15794
Published: 2020-10-15
Description: A vulnerability has been identified in Desigo Insight (All versions). Some error messages in the web application show the absolute path to the requested resource. This could allow an authenticated attacker to retrieve additional information about the host system.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200, CWE-209
References: https://cert-portal.siemens.com/productcert/pdf/ssa-226339.pdf; https://us-cert.cisa.gov/ics/advisories/icsa-20-287-05; https://cert-portal.siemens.com/productcert/pdf/ssa-226339.pdf
CVE: CVE-2020-1777
Published: 2020-10-15
Description: Agent names that participates in a chat conversation are revealed in certain parts of the external interface as well as in chat transcriptions inside the tickets, when system is configured to mask real agent names. This issue affects OTRS; 7.0.21 and prior versions, 8.0.6 and prior versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200, CWE-200
References: https://otrs.com/release-notes/otrs-security-advisory-2020-15/; https://otrs.com/release-notes/otrs-security-advisory-2020-15/
CVE: CVE-2020-7591
Published: 2020-10-15
Description: A vulnerability has been identified in SIPORT MP (All versions < 3.2.1). Vulnerable versions of the device could allow an authenticated attacker to impersonate other users of the system and perform (potentially administrative) actions on behalf of those users if the single sign-on feature ("Allow logon without password") is enabled.
CVSS Score: 8.8 (HIGH)
CWE: CWE-603, CWE-287
References: https://cert-portal.siemens.com/productcert/pdf/ssa-384879.pdf; https://us-cert.cisa.gov/ics/advisories/icsa-20-287-06; https://cert-portal.siemens.com/productcert/pdf/ssa-384879.pdf
CVE: CVE-2019-17640
Published: 2020-10-15
Description: In Eclipse Vert.x 3.4.x up to 3.9.4, 4.0.0.milestone1, 4.0.0.milestone2, 4.0.0.milestone3, 4.0.0.milestone4, 4.0.0.milestone5, 4.0.0.Beta1, 4.0.0.Beta2, and 4.0.0.Beta3, StaticHandler doesn't correctly processes back slashes on Windows Operating systems, allowing, escape the webroot folder to the current working directory.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-23, CWE-22
References: https://bugs.eclipse.org/bugs/show_bug.cgi?id=567416; https://lists.apache.org/thread.html/r591f6932560c8c46cee87415afed92924a982189fea7f7c9096f8e33%40%3Ccommits.pulsar.apache.org%3E; https://lists.apache.org/thread.html/r8383b5e7344a8b872e430ad72241b84b83e9701d275c602cfe34a941%40%3Ccommits.servicecomb.apache.org%3E
CVE: CVE-2020-14185
Published: 2020-10-15
Description: Affected versions of Jira Server allow remote unauthenticated attackers to enumerate issue keys via a missing permissions check in the ActionsAndOperations resource. The affected versions are before 7.13.18, from version 8.0.0 before 8.5.9, and from version 8.6.0 before version 8.12.2.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://jira.atlassian.com/browse/JRASERVER-71696; https://jira.atlassian.com/browse/JRASERVER-71696
CVE: CVE-2020-27163
Published: 2020-10-16
Description: phpRedisAdmin before 1.13.2 allows XSS via the login.php username parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/erikdubbelboer/phpRedisAdmin/commit/eddaa674536d2e76e6d0b4efeb00604e992eab8f; https://github.com/erikdubbelboer/phpRedisAdmin/commit/eddaa674536d2e76e6d0b4efeb00604e992eab8f
CVE: CVE-2020-27173
Published: 2020-10-16
Description: In vm-superio before 0.1.1, the serial console FIFO can grow to unlimited memory usage when data is sent to the input source (i.e., standard input). This behavior cannot be reproduced from the guest side. When no rate limiting is in place, the host can be subject to memory pressure, impacting all other VMs running on the same host.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://github.com/rust-vmm/vm-superio/issues/17; https://github.com/rust-vmm/vm-superio/pull/19; https://github.com/rust-vmm/vm-superio/issues/17
CVE: CVE-2020-27174
Published: 2020-10-16
Description: In Amazon AWS Firecracker before 0.21.3, and 0.22.x before 0.22.1, the serial console buffer can grow its memory usage without limit when data is sent to the standard input. This can result in a memory leak on the microVM emulation thread, possibly occupying more memory than intended on the host.
CVSS Score: 7.5 (HIGH)
CWE: CWE-401
References: http://www.openwall.com/lists/oss-security/2020/10/23/1; https://github.com/firecracker-microvm/firecracker/issues/2177; https://github.com/firecracker-microvm/firecracker/pull/2178
CVE: CVE-2020-27176
Published: 2020-10-16
Description: Mutation XSS exists in Mark Text through 0.16.2 that leads to Remote Code Execution. NOTE: this might be considered a duplicate of CVE-2020-26870; however, it can also be considered an issue in the design of the "source code mode" feature, which parses HTML even though HTML support is not one of the primary advertised roles of the product.
CVSS Score: 8.3 (HIGH)
CWE: CWE-79
References: https://github.com/marktext/marktext/issues/2360; https://github.com/marktext/marktext/issues/2360
CVE: CVE-2020-24352
Published: 2020-10-16
Description: An issue was discovered in QEMU through 5.1.0. An out-of-bounds memory access was found in the ATI VGA device implementation. This flaw occurs in the ati_2d_blt() routine in hw/display/ati_2d.c while handling MMIO write operations through the ati_mm_write() callback. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-787
References: https://bugzilla.redhat.com/show_bug.cgi?id=1847584; https://git.qemu.org/?p=qemu.git; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2020-25829
Published: 2020-10-16
Description: An issue has been found in PowerDNS Recursor before 4.1.18, 4.2.x before 4.2.5, and 4.3.x before 4.3.5. A remote attacker can cause the cached records for a given name to be updated to the Bogus DNSSEC validation state, instead of their actual DNSSEC Secure state, via a DNS ANY query. This results in a denial of service for installation that always validate (dnssec=validate), and for clients requesting validation when on-demand validation is enabled (dnssec=process).
CVSS Score: 7.5 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00036.html; https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2020-07.html; https://security.gentoo.org/glsa/202012-19
CVE: CVE-2020-26583
Published: 2020-10-16
Description: An issue was discovered in Sage DPW 2020_06_x before 2020_06_002. It allows unauthenticated users to upload JavaScript (in a file) via the expenses claiming functionality. However, to view the file, authentication is required. By exploiting this vulnerability, an attacker can persistently include arbitrary HTML or JavaScript code into the affected web page. The vulnerability can be used to change the contents of the displayed site, redirect to other sites, or steal user credentials. Additionally, users are potential victims of browser exploits and JavaScript malware.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-434
References: https://sec-consult.com/en/vulnerability-lab/advisories/; https://seclists.org/fulldisclosure/2020/Oct/17; https://www.sagedpw.at
CVE: CVE-2020-26584
Published: 2020-10-16
Description: An issue was discovered in Sage DPW 2020_06_x before 2020_06_002. The search field "Kurs suchen" on the page Kurskatalog is vulnerable to Reflected XSS. If the attacker can lure a user into clicking a crafted link, he can execute arbitrary JavaScript code in the user's browser. The vulnerability can be used to change the contents of the displayed site, redirect to other sites, or steal user credentials. Additionally, users are potential victims of browser exploits and JavaScript malware.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://sec-consult.com/en/vulnerability-lab/advisories/; https://seclists.org/fulldisclosure/2020/Oct/17; https://www.sagedpw.at
CVE: CVE-2020-26943
Published: 2020-10-16
Description: An issue was discovered in OpenStack blazar-dashboard before 1.3.1, 2.0.0, and 3.0.0. A user allowed to access the Blazar dashboard in Horizon may trigger code execution on the Horizon host as the user the Horizon service runs under (because the Python eval function is used). This may result in Horizon host unauthorized access and further compromise of the Horizon service. All setups using the Horizon dashboard with the blazar-dashboard plugin are affected.
CVSS Score: 9.9 (CRITICAL)
References: http://www.openwall.com/lists/oss-security/2020/10/16/5; https://launchpad.net/bugs/1895688; https://review.opendev.org/755810
CVE: CVE-2019-18794
Published: 2020-10-16
Description: The BASS Audio Library 2.4.14 under Windows is prone to a BASS_StreamCreateFile Use after Free vulnerability via a crafted .ogg file. An attacker can exploit this to gain access to sensitive information that may aid in further attacks. A failure in exploitation leads to denial of service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-416
References: http://www.un4seen.com/; https://github.com/staufnic/CVE/tree/master/CVE-2019-18794; http://www.un4seen.com/
CVE: CVE-2019-18795
Published: 2020-10-16
Description: The BASS Audio Library 2.4.14 under Windows is prone to a BASS_StreamCreateFile out of bounds read vulnerability via a crafted .wav file. An attacker can exploit this issues to gain access to sensitive information that may aid in further attacks. A failure in exploitation leads to denial of service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: http://www.un4seen.com/; https://github.com/staufnic/CVE/tree/master/CVE-2019-18795; http://www.un4seen.com/
CVE: CVE-2019-18796
Published: 2020-10-16
Description: The BASS Audio Library 2.4.14 under Windows is prone to a BASS_StreamCreateFile Denial of Service vulnerability (infinite loop) via a crafted .mp3 file. This weakness could allow attackers to consume excessive CPU and the application becomes unresponsive.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-835
References: http://www.un4seen.com/; https://github.com/staufnic/CVE/tree/master/CVE-2019-18796; http://www.un4seen.com/
CVE: CVE-2019-19513
Published: 2020-10-16
Description: The BASSMIDI plugin 2.4.12.1 for Un4seen BASS Audio Library on Windows is prone to an out of bounds write vulnerability. An attacker may exploit this to execute code on the target machine. A failure in exploitation leads to a denial of service.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://www.un4seen.com/; https://github.com/staufnic/CVE/tree/master/CVE-2019-19513; http://www.un4seen.com/
CVE: CVE-2019-19885
Published: 2020-10-16
Description: In Bender COMTRAXX, user authorization is validated for most, but not all, routes in the system. A user with knowledge about the routes can read and write configuration data without prior authorization. This affects COM465IP, COM465DP, COM465ID, CP700, CP907, and CP915 devices before 4.2.0.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-862
References: https://cert.vde.com/en-us/advisories/vde-2020-043; https://cert.vde.com/en-us/advisories/vde-2020-043
CVE: CVE-2020-26893
Published: 2020-10-16
Description: An issue was discovered in ClamXAV 3 before 3.1.1. A malicious actor could use a properly signed copy of ClamXAV 2 (running with an injected malicious dylib) to communicate with ClamXAV 3's helper tool and perform privileged operations. This occurs because of inadequate client verification in the helper tool.
CVSS Score: 7.8 (HIGH)
CWE: CWE-345
References: https://gist.github.com/matt-clamxav/d341bd48f12a14d2147f8ce860bb36d0; https://gist.github.com/matt-clamxav/d341bd48f12a14d2147f8ce860bb36d0
CVE: CVE-2020-14144
Published: 2020-10-16
Description: The git hook feature in Gitea 1.1.0 through 1.12.5 might allow for authenticated remote code execution in customer environments where the documentation was not understood (e.g., one viewpoint is that the dangerousness of this feature should be documented immediately above the ENABLE_GIT_HOOKS line in the config file). NOTE: The vendor has indicated this is not a vulnerability and states "This is a functionality of the software that is limited to a very limited subset of accounts. If you give someone the privilege to execute arbitrary code on your server, they can execute arbitrary code on your server. We provide very clear warnings to users around this functionality and what it provides.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: http://packetstormsecurity.com/files/162122/Gitea-Git-Hooks-Remote-Code-Execution.html; https://docs.github.com/en/enterprise-server%402.19/admin/policies/creating-a-pre-receive-hook-script; https://docs.gitlab.com/ee/administration/server_hooks.html
CVE: CVE-2020-14299
Published: 2020-10-16
Description: A flaw was found in JBoss EAP, where the authentication configuration is set-up using a legacy SecurityRealm, to delegate to a legacy PicketBox SecurityDomain, and then reloaded to admin-only mode. This flaw allows an attacker to perform a complete authentication bypass by using an arbitrary user and password. The highest threat to vulnerability is to system availability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-287, CWE-287
References: https://bugzilla.redhat.com/show_bug.cgi?id=1848533; https://bugzilla.redhat.com/show_bug.cgi?id=1848533
CVE: CVE-2020-15867
Published: 2020-10-16
Description: The git hook feature in Gogs 0.5.5 through 0.12.2 allows for authenticated remote code execution. There can be a privilege escalation if access to this hook feature is granted to a user who does not have administrative privileges. NOTE: because this is mentioned in the documentation but not in the UI, it could be considered a "Product UI does not Warn User of Unsafe Actions" issue.
CVSS Score: 7.2 (HIGH)
References: http://packetstormsecurity.com/files/162123/Gogs-Git-Hooks-Remote-Code-Execution.html; https://www.fzi.de/en/news/news/detail-en/artikel/fsa-2020-3-schwachstelle-in-gitea-1125-und-gogs-0122-ermoeglicht-ausfuehrung-von-code-nach-authent/; http://packetstormsecurity.com/files/162123/Gogs-Git-Hooks-Remote-Code-Execution.html
CVE: CVE-2020-16270
Published: 2020-10-16
Description: OLIMPOKS under 3.3.39 allows Auth/Admin ErrorMessage XSS. Remote Attacker can use discovered vulnerability to inject malicious JavaScript payload to victim’s browsers in context of vulnerable applications. Executed code can be used to steal administrator’s cookies, influence HTML content of targeted application and perform phishing-related attacks. Vulnerable application used in more than 3000 organizations in different sectors from retail to industries.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://bdu.fstec.ru/vul/2020-04623; https://github.com/Security-AVS/CVE-2020-16270; https://olimpoks.ru/oks/forum/olimpoks5.php
CVE: CVE-2020-26682
Published: 2020-10-16
Description: In libass 0.14.0, the `ass_outline_construct`'s call to `outline_stroke` causes a signed integer overflow.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190
References: http://www.openwall.com/lists/oss-security/2020/11/19/7; https://github.com/libass/libass/issues/431; https://github.com/libass/libass/pull/432
CVE: CVE-2020-26944
Published: 2020-10-16
Description: An issue was discovered in Aptean Product Configurator 4.61.0000 on Windows. A Time based SQL injection affects the nameTxt parameter on the main login page (aka cse?cmd=LOGIN). This can be exploited directly, and remotely.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.aptean.com; https://www.logicallysecure.com/blog/sql-injection-in-aptean/; https://www.aptean.com
CVE: CVE-2020-3991
Published: 2020-10-16
Description: VMware Horizon Client for Windows (5.x before 5.5.0) contains a denial-of-service vulnerability due to a file system access control issue during install time. Successful exploitation of this issue may allow an attacker to overwrite certain admin privileged files through a symbolic link attack at install time. This will result into a denial-of-service condition on the machine where Horizon Client for Windows is installed.
CVSS Score: 7.1 (HIGH)
References: https://www.vmware.com/security/advisories/VMSA-2020-0022.html; https://www.vmware.com/security/advisories/VMSA-2020-0022.html
CVE: CVE-2020-24408
Published: 2020-10-16
Description: Magento versions 2.4.0 and 2.3.5p1 (and earlier) are affected by a persistent XSS vulnerability that allows users to upload malicious JavaScript via the file upload component. This vulnerability could be abused by an unauthenticated attacker to execute XSS attacks against other Magento users. This vulnerability requires a victim to browse to the uploaded file.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://helpx.adobe.com/security/products/magento/apsb20-59.html; https://helpx.adobe.com/security/products/magento/apsb20-59.html
CVE: CVE-2020-26672
Published: 2020-10-16
Description: Testimonial Rotator Wordpress Plugin 3.0.2 is affected by Cross Site Scripting (XSS) in /wp-admin/post.php. If a user intercepts a request and inserts a payload in "cite" parameter, the payload will be stored in the database.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpvulndb.com/vulnerabilities/10272; https://wpvulndb.com/vulnerabilities/10272
CVE: CVE-2020-27178
Published: 2020-10-16
Description: Apereo CAS 5.3.x before 5.3.16, 6.x before 6.1.7.2, 6.2.x before 6.2.4, and 6.3.x before 6.3.0-RC4 mishandles secret keys with Google Authenticator for multifactor authentication.
CVSS Score: 7.5 (HIGH)
References: https://apereo.github.io/2020/10/14/gauthvuln/; https://apereo.github.io/2020/10/14/gauthvuln/
CVE: CVE-2020-15157
Published: 2020-10-16
Description: In containerd (an industry-standard container runtime) before version 1.2.14 there is a credential leaking vulnerability. If a container image manifest in the OCI Image format or Docker Image V2 Schema 2 format includes a URL for the location of a specific image layer (otherwise known as a “foreign layer”), the default containerd resolver will follow that URL to attempt to download it. In v1.2.x but not 1.3.0 or later, the default containerd resolver will provide its authentication credentials if the server where the URL is located presents an HTTP 401 status code along with registry-specific HTTP headers. If an attacker publishes a public image with a manifest that directs one of the layers to be fetched from a web server they control and they trick a user or system into pulling the image, they can obtain the credentials used for pulling that image. In some cases, this may be the user's username and password for the registry. In other cases, this may be the credentials attached to the cloud virtual instance which can grant access to other cloud resources in the account. The default containerd resolver is used by the cri-containerd plugin (which can be used by Kubernetes), the ctr development tool, and other client programs that have explicitly linked against it. This vulnerability has been fixed in containerd 1.2.14. containerd 1.3 and later are not affected. If you are using containerd 1.3 or later, you are not affected. If you are using cri-containerd in the 1.2 series or prior, you should ensure you only pull images from trusted sources. Other container runtimes built on top of containerd but not using the default resolver (such as Docker) are not affected.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-522, CWE-522
References: https://github.com/containerd/containerd/releases/tag/v1.2.14; https://github.com/containerd/containerd/security/advisories/GHSA-742w-89gc-8m9c; https://usn.ubuntu.com/4589-1/
CVE: CVE-2020-15252
Published: 2020-10-16
Description: In XWiki before version 12.5 and 11.10.6, any user with SCRIPT right (EDIT right before XWiki 7.4) can gain access to the application server Servlet context which contains tools allowing to instantiate arbitrary Java objects and invoke methods that may lead to arbitrary code execution. This is patched in XWiki 12.5 and XWiki 11.10.6.
CVSS Score: 8.5 (HIGH)
CWE: CWE-94, CWE-74
References: https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-5hv6-mh8q-q9v8; https://jira.xwiki.org/browse/XWIKI-17141; https://jira.xwiki.org/browse/XWIKI-17423