deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-pw7p-3648-qqmg
Package: com.liferay.portal:release.portal.bom (MAVEN)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: >= 7.2.0, < 7.4.3.5-ga5
Patched in: 7.4.3.5-ga5

Summary: Liferay Portal and Liferay DXP Allows Authenticated Users with View Permissions to Edit Permissions

Details:
Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions does not properly check user permissions, which allows remote authenticated users with the VIEW user permission to edit their own permission via the User and Organizations section of the Control Panel.
GitHub Security Advisory: GHSA-4585-28v2-8h46
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-201: Insertion of Sensitive Information Into Sent Data
Vulnerable versions: >= 7.3.0, < 7.3.10.u4
Patched in: 7.3.10.u4

Summary: Liferay Portal and Liferay DXP Information Disclosure Vulnerability in the Control Panel

Details:
Information disclosure vulnerability in the Control Panel in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions allows remote authenticated users to obtain a user's full name from the page's title by enumerating user screen names.
GitHub Security Advisory: GHSA-4585-28v2-8h46
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-201: Insertion of Sensitive Information Into Sent Data
Vulnerable versions: < 7.2.10.fp19
Patched in: 7.2.10.fp19

Summary: Liferay Portal and Liferay DXP Information Disclosure Vulnerability in the Control Panel

Details:
Information disclosure vulnerability in the Control Panel in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions allows remote authenticated users to obtain a user's full name from the page's title by enumerating user screen names.
GitHub Security Advisory: GHSA-4585-28v2-8h46
Package: com.liferay.portal:release.portal.bom (MAVEN)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-201: Insertion of Sensitive Information Into Sent Data
Vulnerable versions: >= 7.2.0, < 7.4.3.4-ga4
Patched in: 7.4.3.4-ga4

Summary: Liferay Portal and Liferay DXP Information Disclosure Vulnerability in the Control Panel

Details:
Information disclosure vulnerability in the Control Panel in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions allows remote authenticated users to obtain a user's full name from the page's title by enumerating user screen names.
GitHub Security Advisory: GHSA-qpgh-6v9w-vfv6
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: < 7.2.10.fp15
Patched in: 7.2.10.fp15

Summary: Liferay Portal and Liferay DXP Does Not Properly Restrict Membership to Child Site Based on Parent Site Options

Details:
Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions does not properly restrict membership of a child site when the "Limit membership to members of the parent site" option is enabled, which allows remote authenticated users to add users who are not a member of the parent site to a child site. The added user may obtain permission to perform unauthorized actions in the child site.
GitHub Security Advisory: GHSA-qpgh-6v9w-vfv6
Package: com.liferay.portal:release.portal.bom (MAVEN)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: >= 7.2.0, < 7.4.2-ga3
Patched in: 7.4.2-ga3

Summary: Liferay Portal and Liferay DXP Does Not Properly Restrict Membership to Child Site Based on Parent Site Options

Details:
Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions does not properly restrict membership of a child site when the "Limit membership to members of the parent site" option is enabled, which allows remote authenticated users to add users who are not a member of the parent site to a child site. The added user may obtain permission to perform unauthorized actions in the child site.
GitHub Security Advisory: GHSA-3mrr-cw9q-727m
Package: com.liferay:com.liferay.adaptive.media.web (MAVEN)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
Vulnerable versions: >= 7.4.0, <= 7.4.13.u92
Patched in: unpatched

Summary: Liferay Vulnerable to Open Redirect via Adaptive Media Administration Page

Details:
Open redirect vulnerability in adaptive media administration page in Liferay DXP 2023.Q3 before patch 6, and 7.4 GA through update 92 allows remote attackers to redirect users to arbitrary external URLs via the _com_liferay_adaptive_media_web_portlet_AMPortlet_redirect parameter.
GitHub Security Advisory: GHSA-3mrr-cw9q-727m
Package: com.liferay:com.liferay.adaptive.media.web (MAVEN)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
Vulnerable versions: >= 2023.Q3, < 2023.Q3.6
Patched in: 2023.Q3.6

Summary: Liferay Vulnerable to Open Redirect via Adaptive Media Administration Page

Details:
Open redirect vulnerability in adaptive media administration page in Liferay DXP 2023.Q3 before patch 6, and 7.4 GA through update 92 allows remote attackers to redirect users to arbitrary external URLs via the _com_liferay_adaptive_media_web_portlet_AMPortlet_redirect parameter.
GitHub Security Advisory: GHSA-f3rf-cr7f-cwc4
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
Vulnerable versions: >= 7.4.13.u45, <= 7.4.13.u92
Patched in: unpatched

Summary: Liferay Portal and Liferay DXP Vulnerable to Open Redirect in Countries Management's Edit Region Page

Details:
Open redirect vulnerability in the Countries Management’s edit region page in Liferay Portal 7.4.3.45 through 7.4.3.101, and Liferay DXP 2023.Q3 before patch 6, and 7.4 update 45 through 92 allows remote attackers to redirect users to arbitrary external URLs via the _com_liferay_address_web_internal_portlet_CountriesManagementAdminPortlet_redirect parameter.
GitHub Security Advisory: GHSA-f3rf-cr7f-cwc4
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
Vulnerable versions: >= 2023.Q3, < 2023.Q3.6
Patched in: 2023.Q3.6

Summary: Liferay Portal and Liferay DXP Vulnerable to Open Redirect in Countries Management's Edit Region Page

Details:
Open redirect vulnerability in the Countries Management’s edit region page in Liferay Portal 7.4.3.45 through 7.4.3.101, and Liferay DXP 2023.Q3 before patch 6, and 7.4 update 45 through 92 allows remote attackers to redirect users to arbitrary external URLs via the _com_liferay_address_web_internal_portlet_CountriesManagementAdminPortlet_redirect parameter.
GitHub Security Advisory: GHSA-f3rf-cr7f-cwc4
Package: com.liferay.portal:release.portal.bom (MAVEN)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
Vulnerable versions: >= 7.4.3.45-ga45, < 7.4.3.102-ga102
Patched in: 7.4.3.102-ga102

Summary: Liferay Portal and Liferay DXP Vulnerable to Open Redirect in Countries Management's Edit Region Page

Details:
Open redirect vulnerability in the Countries Management’s edit region page in Liferay Portal 7.4.3.45 through 7.4.3.101, and Liferay DXP 2023.Q3 before patch 6, and 7.4 update 45 through 92 allows remote attackers to redirect users to arbitrary external URLs via the _com_liferay_address_web_internal_portlet_CountriesManagementAdminPortlet_redirect parameter.
GitHub Security Advisory: GHSA-qp68-5v39-r869
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: CRITICAL (CVSS 9.6)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 7.4.0, <= 7.4.13.u92
Patched in: unpatched

Summary: Liferay Portal and Liferay DXP Vulnerable to XSS in the Commerce Module

Details:
Multiple stored cross-site scripting (XSS) vulnerabilities in the Commerce module before 4.0.35 from Liferay Portal (7.3.5 through 7.4.3.91), and Liferay DXP 7.3 update 33 and earlier, and 7.4 before update 92 allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a (1) Shipping Name, (2) Shipping Phone Number, (3) Shipping Address, (4) Shipping Address 2, (5) Shipping Address 3, (6) Shipping Zip, (7) Shipping City, (8) Shipping Region (9), Shipping Country, (10) Billing Name, (11) Billing Phone Number, (12) Billing Address, (13) Billing Address 2, (14) Billing Address 3, (15) Billing Zip, (16) Billing City, (17) Billing Region, (18) Billing Country, or (19) Region Code.
GitHub Security Advisory: GHSA-qp68-5v39-r869
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: CRITICAL (CVSS 9.6)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 7.3.0, <= 7.3.10.u33
Patched in: unpatched

Summary: Liferay Portal and Liferay DXP Vulnerable to XSS in the Commerce Module

Details:
Multiple stored cross-site scripting (XSS) vulnerabilities in the Commerce module before 4.0.35 from Liferay Portal (7.3.5 through 7.4.3.91), and Liferay DXP 7.3 update 33 and earlier, and 7.4 before update 92 allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a (1) Shipping Name, (2) Shipping Phone Number, (3) Shipping Address, (4) Shipping Address 2, (5) Shipping Address 3, (6) Shipping Zip, (7) Shipping City, (8) Shipping Region (9), Shipping Country, (10) Billing Name, (11) Billing Phone Number, (12) Billing Address, (13) Billing Address 2, (14) Billing Address 3, (15) Billing Zip, (16) Billing City, (17) Billing Region, (18) Billing Country, or (19) Region Code.
GitHub Security Advisory: GHSA-qp68-5v39-r869
Package: com.liferay.commerce:com.liferay.commerce.address.content.web (MAVEN)
Severity: CRITICAL (CVSS 9.6)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 4.0.35
Patched in: 4.0.35

Summary: Liferay Portal and Liferay DXP Vulnerable to XSS in the Commerce Module

Details:
Multiple stored cross-site scripting (XSS) vulnerabilities in the Commerce module before 4.0.35 from Liferay Portal (7.3.5 through 7.4.3.91), and Liferay DXP 7.3 update 33 and earlier, and 7.4 before update 92 allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a (1) Shipping Name, (2) Shipping Phone Number, (3) Shipping Address, (4) Shipping Address 2, (5) Shipping Address 3, (6) Shipping Zip, (7) Shipping City, (8) Shipping Region (9), Shipping Country, (10) Billing Name, (11) Billing Phone Number, (12) Billing Address, (13) Billing Address 2, (14) Billing Address 3, (15) Billing Zip, (16) Billing City, (17) Billing Region, (18) Billing Country, or (19) Region Code.
GitHub Security Advisory: GHSA-hv45-r2f5-fmhj
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: CRITICAL (CVSS 9.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 7.4.0, < 7.4.13.u88
Patched in: 7.4.13.u88

Summary: Liferay Portal and Liferay DXP Vulnerable to XSS in the Wiki Widget

Details:
Stored cross-site scripting (XSS) vulnerability in the Wiki widget in Liferay Wiki Web before 7.0.95 from Liferay Portal (7.1.0 through 7.4.3.87), and Liferay DXP 7.0 fix pack 83 through 102, 7.1 fix pack 28 and earlier, 7.2 fix pack 20 and earlier, 7.3 update 33 and earlier, and 7.4 before update 88 allows remote attackers to inject arbitrary web script or HTML into a parent wiki page via a crafted payload injected into a wiki page's ‘Content’ text field.
GitHub Security Advisory: GHSA-hv45-r2f5-fmhj
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: CRITICAL (CVSS 9.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 7.3.0, < 7.3.10.u34
Patched in: 7.3.10.u34

Summary: Liferay Portal and Liferay DXP Vulnerable to XSS in the Wiki Widget

Details:
Stored cross-site scripting (XSS) vulnerability in the Wiki widget in Liferay Wiki Web before 7.0.95 from Liferay Portal (7.1.0 through 7.4.3.87), and Liferay DXP 7.0 fix pack 83 through 102, 7.1 fix pack 28 and earlier, 7.2 fix pack 20 and earlier, 7.3 update 33 and earlier, and 7.4 before update 88 allows remote attackers to inject arbitrary web script or HTML into a parent wiki page via a crafted payload injected into a wiki page's ‘Content’ text field.
GitHub Security Advisory: GHSA-hv45-r2f5-fmhj
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: CRITICAL (CVSS 9.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 7.2.0, <= 7.2.10.fp20
Patched in: unpatched

Summary: Liferay Portal and Liferay DXP Vulnerable to XSS in the Wiki Widget

Details:
Stored cross-site scripting (XSS) vulnerability in the Wiki widget in Liferay Wiki Web before 7.0.95 from Liferay Portal (7.1.0 through 7.4.3.87), and Liferay DXP 7.0 fix pack 83 through 102, 7.1 fix pack 28 and earlier, 7.2 fix pack 20 and earlier, 7.3 update 33 and earlier, and 7.4 before update 88 allows remote attackers to inject arbitrary web script or HTML into a parent wiki page via a crafted payload injected into a wiki page's ‘Content’ text field.
GitHub Security Advisory: GHSA-hv45-r2f5-fmhj
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: CRITICAL (CVSS 9.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 7.1.0, <= 7.1.10.fp28
Patched in: unpatched

Summary: Liferay Portal and Liferay DXP Vulnerable to XSS in the Wiki Widget

Details:
Stored cross-site scripting (XSS) vulnerability in the Wiki widget in Liferay Wiki Web before 7.0.95 from Liferay Portal (7.1.0 through 7.4.3.87), and Liferay DXP 7.0 fix pack 83 through 102, 7.1 fix pack 28 and earlier, 7.2 fix pack 20 and earlier, 7.3 update 33 and earlier, and 7.4 before update 88 allows remote attackers to inject arbitrary web script or HTML into a parent wiki page via a crafted payload injected into a wiki page's ‘Content’ text field.
GitHub Security Advisory: GHSA-hv45-r2f5-fmhj
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: CRITICAL (CVSS 9.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 7.0.10.fp83, <= 7.0.10.fp102
Patched in: unpatched

Summary: Liferay Portal and Liferay DXP Vulnerable to XSS in the Wiki Widget

Details:
Stored cross-site scripting (XSS) vulnerability in the Wiki widget in Liferay Wiki Web before 7.0.95 from Liferay Portal (7.1.0 through 7.4.3.87), and Liferay DXP 7.0 fix pack 83 through 102, 7.1 fix pack 28 and earlier, 7.2 fix pack 20 and earlier, 7.3 update 33 and earlier, and 7.4 before update 88 allows remote attackers to inject arbitrary web script or HTML into a parent wiki page via a crafted payload injected into a wiki page's ‘Content’ text field.
GitHub Security Advisory: GHSA-hv45-r2f5-fmhj
Package: com.liferay:com.liferay.wiki.web (MAVEN)
Severity: CRITICAL (CVSS 9.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 7.0.95
Patched in: 7.0.95

Summary: Liferay Portal and Liferay DXP Vulnerable to XSS in the Wiki Widget

Details:
Stored cross-site scripting (XSS) vulnerability in the Wiki widget in Liferay Wiki Web before 7.0.95 from Liferay Portal (7.1.0 through 7.4.3.87), and Liferay DXP 7.0 fix pack 83 through 102, 7.1 fix pack 28 and earlier, 7.2 fix pack 20 and earlier, 7.3 update 33 and earlier, and 7.4 before update 88 allows remote attackers to inject arbitrary web script or HTML into a parent wiki page via a crafted payload injected into a wiki page's ‘Content’ text field.
GitHub Security Advisory: GHSA-6j2q-c73v-97c5
Package: org.springframework.cloud:spring-cloud-gateway-server-mvc (MAVEN)
Severity: HIGH (CVSS 8.6)
CWE: CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Vulnerable versions: >= 4.1.7, < 4.2.3
Patched in: 4.2.3

Summary: Spring Cloud Gateway Server Forwards Headers from Untrusted Proxies

Details:
Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies.
GitHub Security Advisory: GHSA-6j2q-c73v-97c5
Package: org.springframework.cloud:spring-cloud-gateway-server (MAVEN)
Severity: HIGH (CVSS 8.6)
CWE: CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Vulnerable versions: < 3.1.10
Patched in: 3.1.10

Summary: Spring Cloud Gateway Server Forwards Headers from Untrusted Proxies

Details:
Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies.
GitHub Security Advisory: GHSA-j63h-hmgw-x4j7
Package: org.opencastproject:opencast-publication-service-oaipmh-remote (MAVEN)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, CWE-522: Insufficiently Protected Credentials
Vulnerable versions: < 17.6
Patched in: 17.6

Summary: Opencast still publishes global system account credentials 

Details:
### Description
Opencast prior to versions 17.6 would incorrectly send the hashed global system account credentials (ie: `org.opencastproject.security.digest.user` and `org.opencastproject.security.digest.pass`) when attempting to fetch mediapackage elements included in a mediapackage XML file.  A [previous CVE](https://github.com/opencast/opencast/security/advisories/GHSA-hcxx-mp6g-6gr9) prevented many cases where the credentials were inappropriately sent, but not all.  The remainder are addressed with this patch.

### Impact
Anyone with ingest permissions could cause Opencast to send its hashed global system account credentials to a url of their choosing.

### Patches
This issue is fixed in Opencast 17.6

If you have any questions or comments about this advisory:
- Open an issue in our [issue tracker](https://github.com/opencast/opencast/issues)
- Email us at security@opencast.org
GitHub Security Advisory: GHSA-j63h-hmgw-x4j7
Package: org.opencastproject:opencast-kernel (MAVEN)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, CWE-522: Insufficiently Protected Credentials
Vulnerable versions: < 17.6
Patched in: 17.6

Summary: Opencast still publishes global system account credentials 

Details:
### Description
Opencast prior to versions 17.6 would incorrectly send the hashed global system account credentials (ie: `org.opencastproject.security.digest.user` and `org.opencastproject.security.digest.pass`) when attempting to fetch mediapackage elements included in a mediapackage XML file.  A [previous CVE](https://github.com/opencast/opencast/security/advisories/GHSA-hcxx-mp6g-6gr9) prevented many cases where the credentials were inappropriately sent, but not all.  The remainder are addressed with this patch.

### Impact
Anyone with ingest permissions could cause Opencast to send its hashed global system account credentials to a url of their choosing.

### Patches
This issue is fixed in Opencast 17.6

If you have any questions or comments about this advisory:
- Open an issue in our [issue tracker](https://github.com/opencast/opencast/issues)
- Email us at security@opencast.org
GitHub Security Advisory: GHSA-j63h-hmgw-x4j7
Package: org.opencastproject:opencast-ingest-service-impl (MAVEN)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, CWE-522: Insufficiently Protected Credentials
Vulnerable versions: < 17.6
Patched in: 17.6

Summary: Opencast still publishes global system account credentials 

Details:
### Description
Opencast prior to versions 17.6 would incorrectly send the hashed global system account credentials (ie: `org.opencastproject.security.digest.user` and `org.opencastproject.security.digest.pass`) when attempting to fetch mediapackage elements included in a mediapackage XML file.  A [previous CVE](https://github.com/opencast/opencast/security/advisories/GHSA-hcxx-mp6g-6gr9) prevented many cases where the credentials were inappropriately sent, but not all.  The remainder are addressed with this patch.

### Impact
Anyone with ingest permissions could cause Opencast to send its hashed global system account credentials to a url of their choosing.

### Patches
This issue is fixed in Opencast 17.6

If you have any questions or comments about this advisory:
- Open an issue in our [issue tracker](https://github.com/opencast/opencast/issues)
- Email us at security@opencast.org
GitHub Security Advisory: GHSA-j63h-hmgw-x4j7
Package: org.opencastproject:opencast-common (MAVEN)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, CWE-522: Insufficiently Protected Credentials
Vulnerable versions: < 17.6
Patched in: 17.6

Summary: Opencast still publishes global system account credentials 

Details:
### Description
Opencast prior to versions 17.6 would incorrectly send the hashed global system account credentials (ie: `org.opencastproject.security.digest.user` and `org.opencastproject.security.digest.pass`) when attempting to fetch mediapackage elements included in a mediapackage XML file.  A [previous CVE](https://github.com/opencast/opencast/security/advisories/GHSA-hcxx-mp6g-6gr9) prevented many cases where the credentials were inappropriately sent, but not all.  The remainder are addressed with this patch.

### Impact
Anyone with ingest permissions could cause Opencast to send its hashed global system account credentials to a url of their choosing.

### Patches
This issue is fixed in Opencast 17.6

If you have any questions or comments about this advisory:
- Open an issue in our [issue tracker](https://github.com/opencast/opencast/issues)
- Email us at security@opencast.org
GitHub Security Advisory: GHSA-p9qm-p942-q3w5
Package: org.xwiki.platform:xwiki-platform-oldcore (MAVEN)
Severity: HIGH (CVSS 0.0)
CWE: CWE-20: Improper Input Validation, CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: >= 17.0.0-rc1, < 17.3.0-rc-1
Patched in: 17.3.0-rc-1

Summary: XWiki Platform vulnerable to SQL injection through XWiki#searchDocuments API

Details:
### Impact

It's possible to execute any SQL query in Oracle by using the function like [DBMS_XMLGEN or DBMS_XMLQUERY](https://docs.oracle.com/en/database/oracle/oracle-database/19/arpls/DBMS_XMLGEN.html).

The XWiki#searchDocuments APIs are not sanitizing the query at all and even if they force a specific select, Hibernate allows using any native function in an HQL query (for example in the WHERE).

### Patches

This has been patched in 16.10.6 and 17.3.0-rc-1.

### Workarounds

There is no known workaround, other than upgrading XWiki.

### References

https://jira.xwiki.org/browse/XWIKI-22728

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)
* Email us at [Security Mailing List](mailto:security@xwiki.org)