hitoshura25/cvefixes huggingface dataset:
CVE-2023-26056 (Java, published 2023-03-02T19:15Z)
Description: value: XWiki Platform is a generic wiki platform. Starting in version 3.0-milestone-1, it's possible to execute a script with the right of another user, provided the target user does not have programming right. The problem has been patched in XWiki 14.8-rc-1, 14.4.5, and 13.10.10. There are no known workarounds for this issue.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-863 \u2014 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
Repository: https://github.com/xwiki/xwiki-platform
Files changed:
xwiki-platform-core/xwiki-platform-rendering/xwiki-platform-rendering-macros/xwiki-platform-rendering-macro-context/src/main/java/org/xwiki/rendering/internal/macro/context/ContextMacro.java
Commit message: XWIKI-19856: Bad execution setup on the context macro


Vulnerable code:
        // Configure the Transformation Context XDOM depending on the mode asked.
        configuration.setXDOM(getXDOM(referencedDocReference, parameters));


Fixed code:
            // Configure the Transformation Context XDOM depending on the mode asked.
            configuration.setXDOM(getXDOM(referencedDocReference, parameters));
CVE-2023-26470 (Java, published 2023-03-02T19:15Z)
Description: value: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to make the farm unusable by adding an object to a page with a huge number (e.g. 67108863). Most of the time this will fill the memory allocated to XWiki and make it unusable every time this document is manipulated. This issue has been patched in XWiki 14.0-rc-1.

Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/xwiki/xwiki-platform
Files changed:
xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/internal/doc/BaseObjects.java
xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/internal/doc/BaseObjectsTest.java
Commit message: XWIKI-19223: Improve xobject memory storage in XWikidocument
* fix List#remove implementation
* override List#clear implementation for performances


Vulnerable code:
        // Move right values
        return this.map.remove(index);
        objects.remove(2);
        assertNull(objects.get(0));
        assertSame(XOBJ2, objects.get(1));
        assertNull(objects.get(2));

Fixed code:
        // Shifts right values to the right
        BaseObject previous = this.map.remove(index);

        // Shifts right values to the left
        if (index < this.size - 1) {
            for (int i = index; i < this.size - 1; ++i) {
                put(i, get(i + 1));
            }
        }

        // The list is one element shorter
        --this.size;

        return previous;
    }

    @Override
    public void clear()
    {
        this.map.clear();
        this.size = 0;
        assertEquals(2, objects.size());
        assertSame(XOBJ2, objects.get(0));
        assertSame(XOBJ3, objects.get(1));

        objects.remove(1);

        assertEquals(1, objects.size());
        assertSame(XOBJ2, objects.get(0));
    }

    @Test
    void clear()
    {
        BaseObjects objects = new BaseObjects(Arrays.asList(XOBJ1, XOBJ2, XOBJ3));

        objects.clear();

        assertEquals(0, objects.size());
CVE-2023-26470 (XML, published 2023-03-02T19:15Z)
Description: value: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to make the farm unusable by adding an object to a page with a huge number (e.g. 67108863). Most of the time this will fill the memory allocated to XWiki and make it unusable every time this document is manipulated. This issue has been patched in XWiki 14.0-rc-1.

Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/xwiki/xwiki-platform
Files changed:
xwiki-platform-core/xwiki-platform-oldcore/pom.xml
Commit message: XWIKI-19223: Saving a document with a large object number leads to persistent OOM errors


Vulnerable code:

Fixed code:
      <scope>test</scope>
CVE-2023-26475 (Java, published 2023-03-02T19:15Z)
Description: value: XWiki Platform is a generic wiki platform. Starting in version 2.3-milestone-1, the annotation displayer does not execute the content in a restricted context. This allows executing anything with the right of the author of any document by annotating the document. This has been patched in XWiki 13.10.11, 14.4.7 and 14.10. There is no easy workaround except to upgrade.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-269 \u2014 Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
Repository: https://github.com/xwiki/xwiki-platform
Files changed:
xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/internal/mandatory/XWikiCommentsDocumentInitializer.java
Commit message: XWIKI-20384: Use the new textarea restricted setup in comments


Vulnerable code:
        xclass.addTextAreaField(commentPropertyName, "Comment", 40, 5);

Fixed code:
        xclass.addTextAreaField(commentPropertyName, "Comment", 40, 5, true);
CVE-2023-26480 (Java, published 2023-03-02T18:15Z)
Description: value: XWiki Platform is a generic wiki platform. Starting in version 12.10, a user without script rights can introduce a stored cross-site scripting by using the Live Data macro. This has been patched in XWiki 14.9, 14.4.7, and 13.10.10. There are no known workarounds.

Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/xwiki/xwiki-platform
Files changed:
xwiki-platform-core/xwiki-platform-livedata/xwiki-platform-livedata-macro/src/test/java/org/xwiki/livedata/internal/macro/LiveDataMacroComponentList.java
Commit message: XWIKI-20143: Improved Live Data escaping

Add missing components in LiveDataMacroComponentList.


Vulnerable code:
    JsFileSkinExtension.class

Fixed code:
    JsFileSkinExtension.class,
    LiveDataMacroConfiguration.class,
    LiveDataMacroRights.class
CVE-2023-29214 (XML, published 2023-04-16T07:15Z)
Description: value: XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with edit rights can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of the included pages in the IncludedDocuments panel. The problem has been patched on XWiki 14.4.7, and 14.10.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/xwiki/xwiki-platform
Files changed:
xwiki-platform-core/xwiki-platform-panels/xwiki-platform-panels-ui/src/main/resources/Panels/IncludedDocuments.xml
Commit message: XWIKI-20293: Improved IncludedDocuments panel escaping


Vulnerable code:
  * [[$page&gt;&gt;$page]] [[[[image:icon:page_white_edit||alt="$services.localization.render('panels.documentInformation.editIncluded', [$page])"]]&gt;&gt;path:$xwiki.getURL($page, 'edit')]]
      <description>Displays the documents included in the curent document.</description>

Fixed code:
  #set ($pageLink = $services.rendering.escape($page, 'xwiki/2.1'))
  #set ($pageName = $services.rendering.escape($services.rendering.escape($page, 'xwiki/2.1'), 'xwiki/2.1'))
  #set ($alt = $services.rendering.escape($services.localization.render('panels.documentInformation.editIncluded', [$page]), 'xwiki/2.1'))
  * [[$pageName&gt;&gt;$pageLink]] [[[[image:icon:page_white_edit||alt="$alt"]]&gt;&gt;path:$xwiki.getURL($page, 'edit')]]
      <description>Displays the documents included in the current document.</description>
CVE-2023-29509 (XML, published 2023-04-16T08:15Z)
Description: value: XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with view rights on commonly accessible documents can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of the `documentTree` macro parameters in  This macro is installed by default in `FlamingoThemesCode.WebHome`. This page is installed by default. The vulnerability has been patched in XWiki 13.10.11, 14.4.7 and 14.10.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/xwiki/xwiki-platform
Files changed:
xwiki-platform-core/xwiki-platform-flamingo/xwiki-platform-flamingo-theme/xwiki-platform-flamingo-theme-ui/pom.xml
xwiki-platform-core/xwiki-platform-flamingo/xwiki-platform-flamingo-theme/xwiki-platform-flamingo-theme-ui/src/main/resources/FlamingoThemesCode/WebHome.xml
Commit message: XWIKI-20279: Improved escaping in FlamingoThemesCode.WebHome


Vulnerable code:
{{documentTree showTranslations="false" showAttachments="false" root="document:$doc.documentReference" /}}

Fixed code:
    <!-- Required for the documentTree macro. -->
    <dependency>
      <groupId>org.xwiki.platform</groupId>
      <artifactId>xwiki-platform-index-tree-macro</artifactId>
      <version>${project.version}</version>
      <scope>runtime</scope>
      <type>xar</type>
    </dependency>
#set ($documentReference = $services.rendering.escape("document:$doc.documentReference", 'xwiki/2.1'))
{{documentTree
  showTranslations="false"
  showAttachments="false"
  root="$documentReference"
/}}
CVE-2023-29514 (XML, published 2023-04-19T00:15Z)
Description: value: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with edit rights on any document (e.g., their own user profile) can execute code with programming rights, leading to remote code execution. This vulnerability has been patched in XWiki 13.10.11, 14.4.8, 14.10.1 and 15.0 RC1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-74 \u2014 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Repository: https://github.com/xwiki/xwiki-platform
Files changed:
xwiki-platform-core/xwiki-platform-administration/xwiki-platform-administration-test/xwiki-platform-administration-test-docker/src/test/it/org/xwiki/administration/test/ui/PageTemplatesIT.java
xwiki-platform-core/xwiki-platform-administration/xwiki-platform-administration-ui/src/main/resources/XWiki/AdminTemplatesSheet.xml
Commit message: XWIKI-20268: Improve escaping in AdminTemplatesSheet


Vulnerable code:
      * [[$services.rendering.escape($xwiki.getDocument($providerFullname).plainTitle, $xwiki.currentContentSyntaxId)&gt;&gt;$providerFullname]]

Fixed code:
import org.openqa.selenium.WebElement;
    /**
     * The goal of this test is to check that the template provider's title is correctly escaped.
     */
    @Test
    @Order(5)
    void templateProviderTitleEscaping(TestUtils setup, TestReference testReference) throws Exception
    {
        cleanUp(setup, testReference);

        // Create a template
        String templateContent = "Templates are fun";
        String providerName = "{{html}}<span>HTML</span>{{/html}}";
        LocalDocumentReference templateProviderReference = new LocalDocumentReference(providerName,
            testReference.getLocalDocumentReference().getParent());
        createTemplateAndTemplateProvider(setup, templateProviderReference, templateContent,
            "Funny templates", true);

        TemplatesAdministrationSectionPage adminPage = TemplatesAdministrationSectionPage.gotoPage();
        List<WebElement> links = adminPage.getExistingTemplatesLinks();
        assertFalse(links.stream().anyMatch(element -> element.getText().equals("HTML")));
        assertTrue(links.stream().anyMatch(element -> providerName.equals(element.getText())));
    }

      * [[$services.rendering.escape($services.rendering.escape($xwiki.getDocument($providerFullname).plainTitle, $xwiki.currentContentSyntaxId), $xwiki.currentContentSyntaxId)&gt;&gt;$services.rendering.escape($providerFullname, $xwiki.currentContentSyntaxId)]]
CVE-2023-29516 (XML, published 2023-04-19T00:15Z)
Description: value: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with view rights on `XWiki.AttachmentSelector` can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping in the "Cancel and return to page" button. This page is installed by default. This vulnerability has been patched in XWiki 15.0-rc-1, 14.10.1, 14.4.8, and 13.10.11. There are no known workarounds for this vulnerability.

Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-74 \u2014 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Repository: https://github.com/xwiki/xwiki-platform
Files changed:
xwiki-platform-core/xwiki-platform-attachment/xwiki-platform-attachment-ui/src/main/resources/XWiki/AttachmentSelector.xml
xwiki-platform-core/xwiki-platform-attachment/xwiki-platform-attachment-ui/src/test/java/org/xwiki/attachment/AttachmentSelectorPageTest.java
Commit message: XWIKI-20275: Improved escaping on XWiki.AttachmentSelector


Vulnerable code:
  (% class="buttonwrapper secondary" %)[[$services.localization.render("${translationPrefix}.cancel")&gt;&gt;${targetDocument}||class="button secondary" id="attachment-picker-close"]]
    DocumentReferenceConverter.class

Fixed code:
  #set ($cancelLinkName = $services.rendering.escape($services.rendering.escape($services.localization.render("${translationPrefix}.cancel"), 'xwiki/2.1'), 'xwiki/2.1'))
  #set ($cancelLinkTarget = $services.rendering.escape($services.model.serialize($targetDocument), 'xwiki/2.1'))
  (% class="buttonwrapper secondary" %)[[$cancelLinkName&gt;&gt;$cancelLinkTarget||class="button secondary" id="attachment-picker-close"]]
import org.xwiki.model.internal.reference.converter.EntityReferenceConverter;
    DocumentReferenceConverter.class,
    EntityReferenceConverter.class,
    ModelScriptService.class,
    @Test
    void cancelButton() throws Exception
    {
        commonFixup("test.png");

        this.request.put("docname", "xwiki:Space.]] {{noscript/}}");

        Document document = renderHTMLPage(new DocumentReference("xwiki", "XWiki", "AttachmentSelector"));
        assertEquals("Space.]] {{noscript/}}", document.getElementById("attachment-picker-close").attr("href"));
    }
CVE-2023-29519 (XML, published 2023-04-19T00:15Z)
Description: value: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A registered user can perform remote code execution leading to privilege escalation by injecting the proper code in the "property" field of an attachment selector, as a gadget of their own dashboard.  Note that the vulnerability does not impact comments of a wiki. The vulnerability has been patched in XWiki 13.10.11, 14.4.8, 14.10.2, 15.0-rc-1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-74 \u2014 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Repository: https://github.com/xwiki/xwiki-platform
Files changed:
xwiki-platform-core/xwiki-platform-attachment/xwiki-platform-attachment-ui/src/main/resources/XWiki/AttachmentSelector.xml
Commit message: XWIKI-20354: Attachment selector properties are missing escaping

  * Avoid breaking html with macro properties values


Vulnerable code:
    {{html}}&lt;input type="hidden" name="${classname}_${object}_${property}" value="${propValue}" class="property-reference"/&gt;{{/html}}##

Fixed code:
    {{html}}&lt;input type="hidden" name="$escapetool.xml("${classname}_${object}_${property}")" value="$escapetool.xml("${propValue}")" class="property-reference"/&gt;{{/html}}##
CVE-2023-29521 (XML, published 2023-04-19T00:15Z)
Description: value: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with view rights can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of `Macro.VFSTreeMacro`. This page is not installed by default.This vulnerability has been patched in XWiki 15.0-rc-1, 14.10.2, 14.4.8, 13.10.11. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-74 \u2014 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Repository: https://github.com/xwiki/xwiki-platform
Files changed:
xwiki-platform-core/xwiki-platform-vfs/xwiki-platform-vfs-ui/pom.xml
xwiki-platform-core/xwiki-platform-vfs/xwiki-platform-vfs-ui/src/main/resources/Macros/VFSTreeMacro.xml
Commit message: XWIKI-20260: Improved escaping of VFSTreeMacro


Vulnerable code:
{{tree root="$xcontext.macro.params.root" reference="path:$xwiki.getURL($doc.getDocumentReference(), 'get', 'sheet=Macros.VFSTreeJSON&amp;outputSyntax=plain')" links="true"/}}

Fixed code:
    <dependency>
      <groupId>org.xwiki.platform</groupId>
      <artifactId>xwiki-platform-rendering-xwiki</artifactId>
      <version>${project.version}</version>
      <scope>runtime</scope>
    </dependency>
#set ($root = $services.rendering.escape($xcontext.macro.params.root, 'xwiki/2.1'))
#set ($reference = $services.rendering.escape("path:$xwiki.getURL($doc.getDocumentReference(), 'get', 'sheet=Macros.VFSTreeJSON&amp;outputSyntax=plain')", 'xwiki/2.1'))
{{tree root="$root" reference="$reference" links="true"/}}
CVE-2023-29525 (XML, published 2023-04-19T00:15Z)
Description: value: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Affected versions of xwiki are subject to code injection in the `since` parameter of the `/xwiki/bin/view/XWiki/Notifications/Code/LegacyNotificationAdministration` endpoint. This provides an XWiki syntax injection attack via the since-parameter, allowing privilege escalation from view to programming rights and subsequent code execution privilege. The vulnerability has been patched in XWiki 15.0-rc-1, 14.10.3, 14.4.8 and 14.10.3. Users are advised to upgrade. Users unable to upgrade may modify the page `XWiki.Notifications.Code.LegacyNotificationAdministration` to add the missing escaping. For versions < 14.6-rc-1 a workaround is to modify the file `<xwikiwebapp>/templates/distribution/eventmigration.wiki` to add the missing escaping.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-74 \u2014 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Repository: https://github.com/xwiki/xwiki-platform
Files changed:
xwiki-platform-core/xwiki-platform-legacy/xwiki-platform-legacy-events-hibernate/xwiki-platform-legacy-events-hibernate-ui/src/main/resources/XWiki/Notifications/Code/LegacyNotificationAdministration.xml
Commit message: XWIKI-20287: Improve migration date display


Vulnerable code:
    &lt;input type="date" id="since" name="since" value="$!request.since" max="$datetool.format('yyyy-MM-dd', $datetool.date)"/&gt;

Fixed code:
    &lt;input type="date" id="since" name="since"#if($request.since) value="$escapetool.xml($request.since)"#end max="$datetool.format('yyyy-MM-dd', $datetool.date)"/&gt;
CVE-2023-32069 (XML, published 2023-05-09T16:15Z)
Description: value: XWiki Platform is a generic wiki platform. Starting in version 3.3-milestone-2 and prior to versions 14.10.4 and 15.0-rc-1, it's possible for a user to execute anything with the right of the author of the XWiki.ClassSheet document. This has been patched in XWiki 15.0-rc-1 and 14.10.4. There are no known workarounds.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-863 \u2014 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
Repository: https://github.com/xwiki/xwiki-platform
Files changed:
xwiki-platform-core/xwiki-platform-xclass/xwiki-platform-xclass-ui/src/main/resources/XWiki/ClassSheet.xml
Commit message: XWIKI-20566: Improve Class Sheet display


Vulnerable code:
  {{include reference="" /}}

Fixed code:
  {{include reference="" author="target"/}}