hitoshura25/cvefixes huggingface dataset:
CVE-2022-29258 (XML, published 2022-05-31T17:15Z)
Description: value: XWiki Platform Filter UI provides a generic user interface to convert from a XWiki Filter input stream to an output stream with settings for each stream. Starting with versions 6.0-milestone-2 and 5.4.4 and prior to versions 12.10.11, 14.0-rc-1, 13.4.7, and 13.10.3, XWiki Platform Filter UI contains a possible cross-site scripting vector in the `Filter.FilterStreamDescriptorForm` wiki page related to pretty much all the form fields printed in the home page of the application. The issue is patched in versions 12.10.11, 14.0-rc-1, 13.4.7, and 13.10.3. The easiest workaround is to edit the wiki page `Filter.FilterStreamDescriptorForm` (with wiki editor) according to the instructions in the GitHub Security Advisory.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/xwiki/xwiki-platform
Files changed:
xwiki-platform-core/xwiki-platform-filter/xwiki-platform-filter-ui/src/main/resources/Filter/FilterStreamDescriptorForm.xml
Commit message: XWIKI-19293: Fix bad escaping


Vulnerable code:
          &lt;input type="text" id="$descriptorId" name="$descriptorId" value="#if($request.get($descriptorId))$request.get($descriptorId)#else$descriptor.defaultValue#end"/&gt;
          &lt;input type="text" id="$descriptorId" name="$descriptorId"#if($request.get($descriptorId))value="$request.get($descriptorId)"#end/&gt;

Fixed code:
          &lt;input type="text" id="$descriptorId" name="$descriptorId" value="#if($request.get($descriptorId))$escapetool.xml($request.get($descriptorId))#else$descriptor.defaultValue#end"/&gt;
          &lt;input type="text" id="$descriptorId" name="$descriptorId"#if($request.get($descriptorId))value="$escapetool.xml($request.get($descriptorId))"#end/&gt;
CVE-2022-36092 (Java, published 2022-09-08T18:15Z)
Description: value: XWiki Platform Old Core is a core package for XWiki Platform, a generic wiki platform. Prior to versions 14.2 and 13.10.4, all rights checks that would normally prevent a user from viewing a document on a wiki can be bypassed using the login action and directly specified templates. This exposes title, content and comments of any document and properties of objects, though class and property name must be known. This is also exploitable on private wikis. This has been patched in versions 14.2 and 13.10.4 by properly checking view rights before loading documents and disallowing non-default templates in the login, registration and skin action. As a workaround, it would be possible to protect all templates individually by adding code to check access rights first.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/xwiki/xwiki-platform
Files changed:
xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/web/RegisterAction.java
Commit message: XWIKI-19549: Disallow template override for login, register and skin

* Also allow `registerinline` template for RegisterAction.


Vulnerable code:
        // Disallow template override with xpage parameter.
        if (!REGISTER.equals(Utils.getPage(context.getRequest(), REGISTER))) {
                String.format("Template may not be overriden with 'xpage' in [%s] action.", REGISTER));

Fixed code:
import java.util.Arrays;
import java.util.List;

    /** Allowed templates for this action. */
    private static final List<String> ALLOWED_TEMPLATES = Arrays.asList(REGISTER, "registerinline");

        // Limit template overrides with xpage to allowed templates.
        if (!ALLOWED_TEMPLATES.contains(Utils.getPage(context.getRequest(), REGISTER))) {
                String.format("Forbidden template override with 'xpage' in [%s] action.", REGISTER));
CVE-2022-36094 (Other, published 2022-09-08T20:15Z)
Description: value: XWiki Platform Web Parent POM contains Web resources for the XWiki platform, a generic wiki platform. Starting with version 1.0 and prior to versions 13.10.6 and 14.30-rc-1, it's possible to store JavaScript which will be executed by anyone viewing the history of an attachment containing javascript in its name. This issue has been patched in XWiki 13.10.6 and 14.3RC1. As a workaround, it is possible to replace `viewattachrev.vm`, the entry point for this attack, by a patched version from the patch without updating XWiki.
Severity: nan (CVSS v3 base score: 9)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/xwiki/xwiki-platform
Files changed:
xwiki-platform-core/xwiki-platform-web/xwiki-platform-web-templates/src/main/resources/templates/viewattachrev.vm
Commit message: XWIKI-19612: XSS in the attachment history


Vulnerable code:
<h3>$services.localization.render("core.viewers.attachments.revisions", [$attachment.filename])</h3>
        <td><img src="${url}" alt="${attachment.filename}" width="80" />

Fixed code:
<h3>$services.localization.render("core.viewers.attachments.revisions", [$escapetool.xml($attachment.filename)])</h3>
        <td><img src="${url}" alt="${escapetool.xml($attachment.filename)}" width="80" />
CVE-2022-36096 (XML, published 2022-09-08T21:15Z)
Description: value: The XWiki Platform Index UI is an Index of all pages, attachments, orphans and deleted pages and attachments for XWiki Platform, a generic wiki platform. Prior to versions 13.10.6 and 14.3, it's possible to store JavaScript which will be executed by anyone viewing the deleted attachments index with an attachment containing javascript in its name. This issue has been patched in XWiki 13.10.6 and 14.3. As a workaround, modify fix the vulnerability by editing the wiki page `XWiki.DeletedAttachments` with the object editor, open the `JavaScriptExtension` object and apply on the content the changes that can be found on the fix commit.
Severity: nan (CVSS v3 base score: 9)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/xwiki/xwiki-platform
Files changed:
xwiki-platform-core/xwiki-platform-index/xwiki-platform-index-ui/src/main/resources/XWiki/DeletedAttachments.xml
Commit message: XWIKI-19613: Bad display in deleted attachments


Vulnerable code:
  var file = new Element('a', {'href' : row.url}).update(row.filename);
  var doc = new Element('a', {'href' : row.documentUrl}).update(row.title);
  tr.appendChild(new Element('td').update(row.date));
  var deleter = new Element('a', {'href' : row.deleterurl}).update(row.deletername);

Fixed code:
  var file = new Element('a', {'href' : row.url}).update((row.filename || '').escapeHTML());
  var doc = new Element('a', {'href' : row.documentUrl}).update((row.title || '').escapeHTML());
  tr.appendChild(new Element('td').update((row.date || '').escapeHTML()));
  var deleter = new Element('a', {'href' : row.deleterurl}).update((row.deletername || '').escapeHTML());
CVE-2022-36098 (XML, published 2022-09-08T21:15Z)
Description: value: XWiki Platform Mentions UI is a user interface for mentioning users in wiki content for XWiki Platform, a generic wiki platform. Starting in version 12.5-rc-1 and prior to versions 13.10.6 and 14.4, it's possible to store Javascript or groovy scripts in a mention, macro anchor, or reference field. The stored code is executed by anyone visiting the page with the mention. This issue has been patched on XWiki 14.4 and 13.10.6. As a workaround, one may update `XWiki.Mentions.MentionsMacro` and edit the `Macro code` field of the `XWiki.WikiMacroClass` XObject.
Severity: nan (CVSS v3 base score: 9)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/xwiki/xwiki-platform
Files changed:
xwiki-platform-core/xwiki-platform-mentions/xwiki-platform-mentions-ui/src/main/resources/XWiki/Mentions/MentionsMacro.xml
Commit message: XWIKI-19752: Improved mentions macro escaping


Vulnerable code:
&lt;a id="$anchor" class="$stringtool.join($cssClasses, ' ')" data-reference="$services.model.serialize($reference.reference, 'default')" href="$link"&gt;$content&lt;/a&gt;

Fixed code:
&lt;a id="$escapetool.xml($anchor)" class="$stringtool.join($cssClasses, ' ')" data-reference="$escapetool.xml($services.model.serialize($reference.reference, 'default'))" href="$escapetool.xml($link)"&gt;
  $escapetool.xml($content)
&lt;/a&gt;
CVE-2022-36099 (XML, published 2022-09-08T21:15Z)
Description: value: XWiki Platform Wiki UI Main Wiki is software for managing subwikis on XWiki Platform, a generic wiki platform. Starting with version 5.3-milestone-2 and prior to versions 13.10.6 and 14.4, it's possible to inject arbitrary wiki syntax including Groovy, Python and Velocity script macros via the request (URL parameter) using the `XWikiServerClassSheet` if the user has view access to this sheet and another page that has been saved with programming rights, a standard condition on a public read-only XWiki installation or a private XWiki installation where the user has an account. This allows arbitrary Groovy/Python/Velocity code execution which allows bypassing all rights checks and thus both modification and disclosure of all content stored in the XWiki installation. Also, this could be used to impact the availability of the wiki. This has been patched in versions 13.10.6 and 14.4. As a workaround, edit the affected document `XWiki.XWikiServerClassSheet` or `WikiManager.XWikiServerClassSheet` and manually perform the changes from the patch fixing the issue. On XWiki versions 12.0 and later, it is also possible to import the document `XWiki.XWikiServerClassSheet` from the xwiki-platform-wiki-ui-mainwiki package version 14.4 using the import feature of the administration application as there have been no other changes to this document since XWiki 12.0.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-116 \u2014 Improper Encoding or Escaping of Output
The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
Repository: https://github.com/xwiki/xwiki-platform
Files changed:
xwiki-platform-core/xwiki-platform-wiki/xwiki-platform-wiki-ui/xwiki-platform-wiki-ui-mainwiki/src/main/resources/XWiki/XWikiServerClassSheet.xml
Commit message: XWIKI-19746: Escape parameters for translation macro in XWikiServerClassSheet


Vulnerable code:
    {{error}}{{translation key="platform.wiki.sheet.erroraliasalreadynotexists" parameters="$request.domain"/}}{{/error}}
    {{error}}{{translation key="platform.wiki.sheet.erroraliasdoesnotexists" parameters="$request.domain"/}}{{/error}}

Fixed code:
    {{error}}{{translation key="platform.wiki.sheet.erroraliasalreadynotexists" parameters="~"${services.rendering.escape($escapetool.java($request.domain), 'xwiki/2.1')}~""/}}{{/error}}
    {{error}}{{translation key="platform.wiki.sheet.erroraliasdoesnotexists" parameters="~"${services.rendering.escape($escapetool.java($request.domain), 'xwiki/2.1')}~""/}}{{/error}}
CVE-2022-41929 (Java, published 2022-11-23T19:15Z)
Description: value: org.xwiki.platform:xwiki-platform-oldcore is missing authorization in User#setDisabledStatus, which may allow an incorrectly authorized user with only Script rights to enable or disable a user. This operation is meant to only be available for users with admin rights. This problem has been patched in XWiki 13.10.7, 14.4.2 and 14.5RC1.
Severity: nan (CVSS v3 base score: 4.9)
Weakness: CWE-862 \u2014 Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Repository: https://github.com/xwiki/xwiki-platform
Files changed:
xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/api/User.java
Commit message: XWIKI-19804: Bulletproof user API


Vulnerable code:
        this.user.setDisabled(disabledStatus, getXWikiContext());

Fixed code:
        if (hasAdminRights()) {
            this.user.setDisabled(disabledStatus, getXWikiContext());
        }
CVE-2022-41930 (XML, published 2022-11-23T19:15Z)
Description: value: org.xwiki.platform:xwiki-platform-user-profile-ui is missing authorization to enable or disable users. Any user (logged in or not) with access to the page XWiki.XWikiUserProfileSheet can enable or disable any user profile. This might allow to a disabled user to re-enable themselves, or to an attacker to disable any user of the wiki. The problem has been patched in XWiki 13.10.7, 14.5RC1 and 14.4.2. Workarounds: The problem can be patched immediately by editing the page `XWiki.XWikiUserProfileSheet` in the wiki and by performing the changes contained in https://github.com/xwiki/xwiki-platform/commit/5be1cc0adf917bf10899c47723fa451e950271fa.
Severity: nan (CVSS v3 base score: 8.2)
Weakness: CWE-862 \u2014 Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Repository: https://github.com/xwiki/xwiki-platform
Files changed:
xwiki-platform-core/xwiki-platform-user/xwiki-platform-user-profile/xwiki-platform-user-profile-ui/src/main/resources/XWiki/XWikiUserProfileSheet.xml
Commit message: XWIKI-19792: User should not be able to disable themselves

  * Prevent user to disable themselves


Vulnerable code:
#if ("$!request.userId" != "" &amp;&amp; ($request.action == "disable" || $request.action == "enable") &amp;&amp; $services.csrf.isTokenValid($request.csrf))
#if ($user.getUser().exists($xcontext.context))

Fixed code:
#if ($hasAdmin &amp;&amp; "$!request.userId" != "" &amp;&amp; ($request.action == "disable" || $request.action == "enable") &amp;&amp; $services.csrf.isTokenValid($request.csrf))
#set ($isCurrentUser = $user.getUser().userReference.equals($xcontext.userReference))
#if (!$isCurrentUser &amp;&amp; $user.getUser().exists($xcontext.context))
CVE-2022-41931 (XML, published 2022-11-23T20:15Z)
Description: value: xwiki-platform-icon-ui is vulnerable to Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection'). Any user with view rights on commonly accessible documents including the icon picker macro can execute arbitrary Groovy, Python or Velocity code in XWiki due to improper neutralization of the macro parameters of the icon picker macro. The problem has been patched in XWiki 13.10.7, 14.5 and 14.4.2. Workarounds: The [patch](https://github.com/xwiki/xwiki-platform/commit/47eb8a5fba550f477944eb6da8ca91b87eaf1d01) can be manually applied by editing `IconThemesCode.IconPickerMacro` in the object editor. The whole document can also be replaced by the current version by importing the document from the XAR archive of a fixed version as the only changes to the document have been security fixes and small formatting changes.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-95 \u2014 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").
Repository: https://github.com/xwiki/xwiki-platform
Files changed:
xwiki-platform-core/xwiki-platform-icon/xwiki-platform-icon-ui/src/main/resources/IconThemesCode/IconPickerMacro.xml
Commit message: XWIKI-19805: Improve parameter escaping in IconPickerMacro


Vulnerable code:
      $('#${xcontext.macro.params.id}').xwikiIconPicker(options);
      $('.${xcontext.macro.params.get('class')}').xwikiIconPicker(options);

Fixed code:
      $('#${escapetool.javascript(${xcontext.macro.params.id})}').xwikiIconPicker(options);
      $('.${escapetool.javascript(${xcontext.macro.params.get('class')})}').xwikiIconPicker(options);
CVE-2022-41935 (XML, published 2022-11-23T20:15Z)
Description: value: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users without the right to view documents can deduce their existence by repeated Livetable queries. The issue has been patched in XWiki 14.6RC1, 13.10.8, and 14.4.3, the response is not properly cleaned up of obfuscated entries. As a workaround, The patch for the document `XWiki.LiveTableResultsMacros` can be manually applied or a XAR archive of a patched version can be imported, on versions 12.10.11, 13.9-rc-1, and 13.4.4. There are no known workarounds for this issue.
Severity: nan (CVSS v3 base score: 4.3)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/xwiki/xwiki-platform
Files changed:
xwiki-platform-core/xwiki-platform-livetable/xwiki-platform-livetable-ui/src/main/resources/XWiki/LiveTableResultsMacros.xml
xwiki-platform-core/xwiki-platform-livetable/xwiki-platform-livetable-ui/src/test/java/org/xwiki/livetable/LiveTableResultsTest.java
Commit message: XWIKI-19999: Livetable sources filtering improvement


Vulnerable code:
  #set($discard = $map.put('returnedrows', $mathtool.min($items.size(), $limit)))

Fixed code:
  #if ($limit > 0)
    #set($discard = $map.put('returnedrows', $mathtool.min($items.size(), $limit)))
  #else
    ## When the limit is 0, it's equivalent to no limit at all and the actual number of returned results can be used.
    #set($discard = $map.put('returnedrows', $items.size()))
  #end
import static java.util.Collections.emptyList;
    @Test
    void removeObfuscatedResultsWhenLimitIs0() throws Exception
    {
        when(this.queryService.hql(anyString())).thenReturn(this.query);
        when(this.query.setLimit(anyInt())).thenReturn(this.query);
        when(this.query.setOffset(anyInt())).thenReturn(this.query);
        when(this.query.bindValues(any(Map.class))).thenReturn(this.query);
        when(this.query.count()).thenReturn(1L);
        when(this.query.execute()).thenReturn(Arrays.asList("XWiki.NotViewable"));

        when(this.oldcore.getMockContextualAuthorizationManager()
            .hasAccess(same(Right.VIEW), eq(new DocumentReference("xwiki", "XWiki", "NotViewable")))).thenReturn(false);

        this.request.put("limit", "0");
        this.request.put("classname", "");
        this.request.put("collist", "doc.title,doc.location,doc.content");
        this.request.put("doc.title", "Sandbo");
        this.request.put("doc.location", "Sandbox.TestPage3");
        this.request.put("doc.content", "dummy");
        this.request.put("limit", "0");

        renderPage();

        assertEquals(0, getTotalRowCount());
        assertEquals(0, getRowCount());
        assertEquals(1, getOffset());
        assertEquals(emptyList(), getRows());
    }
CVE-2022-41937 (XML, published 2022-11-22T01:15Z)
Description: value: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The application allows anyone with view access to modify any page of the wiki by importing a crafted XAR package. The problem has been patched in XWiki 14.6RC1, 14.6 and 13.10.8. As a workaround, setting the right of the page Filter.WebHome and making sure only the main wiki administrators can view the application installed on main wiki or edit the page and apply the changed described in commit fb49b4f.
Severity: nan (CVSS v3 base score: 8.1)
Weakness: CWE-862 \u2014 Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Repository: https://github.com/xwiki/xwiki-platform
Files changed:
xwiki-platform-core/xwiki-platform-filter/xwiki-platform-filter-ui/src/main/resources/Filter/WebHome.xml
Commit message: XWIKI-19758: Better control in Filter application


Vulnerable code:
<xwikidoc version="1.3" reference="Filter.WebHome" locale="">
  <content>{{warning}}Filter module is still young and experimental and while exporting should be safe enough, importing can be more risky for the current instance.{{/warning}}

{{include reference="FilterStreamDescriptorForm"/}}
  &lt;input class="button" type="submit" name="convert" value="Convert"/&gt;

Fixed code:
<xwikidoc version="1.5" reference="Filter.WebHome" locale="">
  <content>{{include reference="FilterStreamDescriptorForm"/}}
  #if ($services.security.authorization.hasAccess('programming', $context.userReference, $doc.documentReference))
  #else
    {{error}}You are not allowed to start a conversion.{{/error}}
  #end
    #if ($services.security.authorization.hasAccess('programming', $context.userReference, $doc.documentReference))
      &lt;input class="button" type="submit" name="convert" value="Convert"/&gt;
    #else
      &lt;input class="button" type="submit" name="convert" value="Convert" disabled title="You are not allowed to start a conversion."/&gt;
    #end
        <defaultValue>long</defaultValue>
        <freeText>forbidden</freeText>
        <largeStorage>0</largeStorage>
        <freeText>forbidden</freeText>
        <largeStorage>0</largeStorage>
CVE-2023-26056 (Java, published 2023-03-02T19:15Z)
Description: value: XWiki Platform is a generic wiki platform. Starting in version 3.0-milestone-1, it's possible to execute a script with the right of another user, provided the target user does not have programming right. The problem has been patched in XWiki 14.8-rc-1, 14.4.5, and 13.10.10. There are no known workarounds for this issue.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-863 \u2014 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
Repository: https://github.com/xwiki/xwiki-platform
Files changed:
xwiki-platform-core/xwiki-platform-rendering/xwiki-platform-rendering-macros/xwiki-platform-rendering-macro-context/src/main/java/org/xwiki/rendering/internal/macro/context/ContextMacro.java
xwiki-platform-core/xwiki-platform-rendering/xwiki-platform-rendering-macros/xwiki-platform-rendering-macro-context/src/test/java/org/xwiki/rendering/internal/macro/context/ContextMacroTest.java
Commit message: XWIKI-19856: Bad execution setup on the context macro
* 13.10.x compatible test


Vulnerable code:
import javax.inject.Inject;
    @Inject
    protected BlockAsyncRendererExecutor executor;

    protected DocumentReferenceResolver<String> resolver;

Fixed code:
        configuration.setAsyncAllowed(false);
        configuration.setCacheAllowed(false);
import org.xwiki.test.junit5.mockito.InjectComponentManager;
import org.xwiki.test.mockito.MockitoComponentManager;
    private DocumentReferenceResolver<String> resolver;
    @InjectComponentManager
    private MockitoComponentManager componentManager;

    private BlockAsyncRendererExecutor executor;


        this.executor = this.componentManager.getInstance(BlockAsyncRendererExecutor.class);