hitoshura25/cvefixes huggingface dataset:
CVE-2023-45133 (JavaScript, published 2023-10-12T17:15Z)
Description: value: Babel is a compiler for writingJavaScript. In `@babel/traverse` prior to versions 7.23.2 and 8.0.0-alpha.4 and all versions of `babel-traverse`, using Babel to compile code that was specifically crafted by an attacker can lead to arbitrary code execution during compilation, when using plugins that rely on the `path.evaluate()`or `path.evaluateTruthy()` internal Babel methods. Known affected plugins are `@babel/plugin-transform-runtime`; `@babel/preset-env` when using its `useBuiltIns` option; and any "polyfill provider" plugin that depends on `@babel/helper-define-polyfill-provider`, such as `babel-plugin-polyfill-corejs3`, `babel-plugin-polyfill-corejs2`, `babel-plugin-polyfill-es-shims`, `babel-plugin-polyfill-regenerator`. No other plugins under the `@babel/` namespace are impacted, but third-party plugins might be. Users that only compile trusted code are not impacted. The vulnerability has been fixed in `@babel/traverse@7.23.2` and `@babel/traverse@8.0.0-alpha.4`. Those who cannot upgrade `@babel/traverse` and are using one of the affected packages mentioned above should upgrade them to their latest version to avoid triggering the vulnerable code path in affected `@babel/traverse` versions: `@babel/plugin-transform-runtime` v7.23.2, `@babel/preset-env` v7.23.2, `@babel/helper-define-polyfill-provider` v0.4.3, `babel-plugin-polyfill-corejs2` v0.4.6, `babel-plugin-polyfill-corejs3` v0.8.5, `babel-plugin-polyfill-es-shims` v0.10.0, `babel-plugin-polyfill-regenerator` v0.5.3.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-697 \u2014 Incorrect Comparison
The product compares two entities in a security-relevant context, but the comparison is incorrect, which may lead to resultant weaknesses.
Repository: https://github.com/babel/babel
Files changed:
packages/babel-traverse/src/path/evaluation.ts
packages/babel-traverse/test/evaluation.js
Commit message: Only evaluate own String/Number/Math methods (#16033)



Vulnerable code:
        // @ts-expect-error property may not exist in context object
        func = context[property.node.name];

Fixed code:
        const key = property.node.name;
        // TODO(Babel 8): Use Object.hasOwn
        if (Object.hasOwnProperty.call(context, key)) {
          func = context[key as keyof typeof context];
        }
  it("should not evaluate inherited methods", function () {
    const path = getPath("Math.hasOwnProperty('min')");
    const evalResult = path.get("body.0.expression").evaluate();
    expect(evalResult.confident).toBe(false);
  });
CVE-2021-32620 (Java, published 2021-05-28T21:15Z)
Description: value: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions prior to 11.10.13, 12.6.7, and 12.10.2, a user disabled on a wiki using email verification for registration canouldre-activate themself by using the activation link provided for his registration. The problem has been patched in the following versions of XWiki: 11.10.13, 12.6.7, 12.10.2, 13.0. It is possible to workaround the issue by resetting the `validkey` property of the disabled XWiki users. This can be done by editing the user profile with object editor.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-863 \u2014 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
Repository: https://github.com/xwiki/xwiki-platform
Files changed:
xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/XWiki.java
xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/XWikiTest.java
Commit message: XWIKI-17942: Email validation check is not properly reset

  * Ensure to reset the validation email key once validated


Vulnerable code:
                saveDocument(userDocument, context);

Fixed code:
                // Ensure to remove the validation key value, so it cannot be used afterwards to enable back
                // a disabled user.
                userObject.setStringValue("validkey", "");
                saveDocument(userDocument, context);

        XWikiDocument reloadedDocument = this.xwiki.getDocument(testUser, context);
        assertEquals("", reloadedDocument.getObject("XWiki.XWikiUsers").getStringValue("validkey"));
CVE-2021-32731 (Other, published 2021-07-01T19:15Z)
Description: value: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Between (and including) versions 13.1RC1 and 13.1, the reset password form reveals the email address of users just by giving their username. The problem has been patched on XWiki 13.2RC1. As a workaround, it is possible to manually modify the `resetpasswordinline.vm` to perform the changes made to mitigate the vulnerability.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/xwiki/xwiki-platform
Files changed:
xwiki-platform-core/xwiki-platform-administration/xwiki-platform-administration-test/xwiki-platform-administration-test-docker/src/test/it/org/xwiki/administration/test/ui/ResetPasswordIT.java
xwiki-platform-core/xwiki-platform-web/src/main/webapp/templates/resetpasswordinline.vm
Commit message: XWIKI-18400: Wrong message after reset password


Vulnerable code:
        resetPasswordPage.clickResetPassword();
            $services.localization.render('xe.admin.passwordReset.emailSent', ["$email"])

Fixed code:
        ResetPasswordPage newResetPasswordPage = resetPasswordPage.clickResetPassword();
        assertTrue(newResetPasswordPage.getMessage().contains("An e-mail was sent"),
            "Actual message: " + newResetPasswordPage.getMessage());
        assertFalse(newResetPasswordPage.getMessage().contains("foo@bar.com"),
            "Actual message: " + newResetPasswordPage.getMessage());
            $services.localization.render('xe.admin.passwordReset.emailSent', ["$services.mail.general.obfuscate($email)"])
CVE-2022-23615 (Other, published 2022-02-09T21:15Z)
Description: value: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with SCRIPT right can save a document with the right of the current user which allow accessing API requiring programming right if the current user has programming right. This has been patched in XWiki 13.0. Users are advised to update to resolve this issue. The only known workaround is to limit SCRIPT access.
Severity: MEDIUM (CVSS v3 base score: 5.4)
Weakness: CWE-863 \u2014 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
Repository: https://github.com/xwiki/xwiki-platform
Files changed:
xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/api/Document.java
xwiki-platform-tools/xwiki-platform-tool-configuration-resources/src/main/resources/xwiki.properties.vm
Commit message: XWIKI-5024: Document potentially saved with the wrong author
* add an configuration off switch


Vulnerable code:
            if (hasProgrammingRights()) {
$!xwikiPropertiesAdditionalProperties

Fixed code:
import org.xwiki.configuration.ConfigurationSource;
import com.xpn.xwiki.internal.XWikiCfgConfigurationSource;
    private ConfigurationSource configuration;

    private ConfigurationSource getConfiguration()
    {
        if (this.configuration == null) {
            this.configuration = Utils.getComponent(ConfigurationSource.class);
        }

        return this.configuration;
    }

            if (hasProgrammingRights() || !getConfiguration().getProperty("security.script.save.checkAuthor", true)) {
#-# [Since 13.0]
#-# Control if document save API should also check the right of the script author when saving a document.
#-# When false only the current user right is checked.
#-#
#-# The default is:
# security.script.save.checkAuthor=true

$!xwikiPropertiesAdditionalProperties
CVE-2022-23617 (Java, published 2022-02-09T21:15Z)
Description: value: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with edit right can copy the content of a page it does not have access to by using it as template of a new page. This issue has been patched in XWiki 13.2CR1 and 12.10.6. Users are advised to update. There are no known workarounds for this issue.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-862 \u2014 Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Repository: https://github.com/xwiki/xwiki-platform
Files changed:
xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/web/CreateAction.java
xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/web/XWikiAction.java
Commit message: XWIKI-18430: Wrong handling of template documents
* improve retro compatibility with future 12.10.x versions


Vulnerable code:
import org.xwiki.model.reference.DocumentReferenceResolver;
    /**
     * Current entity reference resolver hint.
     */
    private static final String CURRENT_MIXED_RESOLVER_HINT = "currentmixed";

    /**
     * @return the resolver uses to resolve references received in request parameters
     */
    private DocumentReferenceResolver<String> getCurrentMixedDocumentReferenceResolver()
    {
        return Utils.getComponent(DocumentReferenceResolver.TYPE_STRING, CURRENT_MIXED_RESOLVER_HINT);
    }

            DocumentReference parentReference = this.currentmixedReferenceResolver.resolve(parent);
    @Inject
    protected ContextualAuthorizationManager autorization;

    @Inject
    @Named("currentmixed")
    protected DocumentReferenceResolver<String> currentmixedReferenceResolver;

            DocumentReference templateReference = this.currentmixedReferenceResolver.resolve(template);
            if (this.autorization.hasAccess(Right.VIEW, templateReference)) {

Fixed code:
            DocumentReference parentReference = getCurrentMixedDocumentReferenceResolver().resolve(parent);
    @Inject
    @Named("currentmixed")
    private DocumentReferenceResolver<String> currentmixedReferenceResolver;

    @Inject
    private ContextualAuthorizationManager autorization;

    /**
     * @since 12.10.6
     * @since 13.2RC1
     */
    protected DocumentReferenceResolver<String> getCurrentMixedDocumentReferenceResolver()
    {
        return this.currentmixedReferenceResolver;
    }

    /**
     * @since 12.10.6
     * @since 13.2RC1
     */
    protected ContextualAuthorizationManager getContextualAuthorizationManager()
    {
        return this.autorization;
    }

            DocumentReference templateReference = getCurrentMixedDocumentReferenceResolver().resolve(template);
            if (getContextualAuthorizationManager().hasAccess(Right.VIEW, templateReference)) {
CVE-2022-23620 (Java, published 2022-02-09T22:15Z)
Description: value: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions AbstractSxExportURLFactoryActionHandler#processSx does not escape anything from SSX document references when serializing it on filesystem, it is possible to for the HTML export process to contain reference elements containing filesystem syntax like "../", "./". or "/" in general. The referenced elements are not properly escaped. This issue has been resolved in version 13.6-rc-1. This issue can be worked around by limiting or disabling document export.
Severity: MEDIUM (CVSS v3 base score: 5.4)
Weakness: CWE-116 \u2014 Improper Encoding or Escaping of Output
The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
Repository: https://github.com/xwiki/xwiki-platform
Files changed:
xwiki-platform-core/xwiki-platform-skin/xwiki-platform-skin-skinx/src/main/java/org/xwiki/skinx/internal/AbstractSxExportURLFactoryActionHandler.java
Commit message: XWIKI-18819: It's possible to save pretty much anything anywhere by creating and using an SSX/JSX containing "../" in its reference


Vulnerable code:
            return processSx(spaceNames, name, queryString, context, exportContext);
    private URL processSx(List<String> spaceNames, String name, String queryString, XWikiContext context,
        String targetPath = String.format("%s/%s/%s", getSxPrefix(), StringUtils.join(spaceNames, '/'), name);
        for (String spaceName : spaceNames) {
            path.append(encodeURLPart(spaceName));
            path.append(URL_PATH_SEPARATOR);
        }
        path.append(encodeURLPart(name));
        // We know we're inside a SX file located at "<S|J>sx/<Space>/<Page>/<s|j>sx<NNN>.<css|js>". Inside this CSS
        // 3 levels up ("../../../").
            exportContext.setDocParentLevels(3);

Fixed code:
            return processSx(sxDocument.getId(), queryString, context, exportContext);
    private URL processSx(long id, String queryString, XWikiContext context,
        String targetPath = String.format("%s/%s", getSxPrefix(), id);
        path.append(id);
        // We know we're inside a SX file located at "<S|J>sx/<id>/<s|j>sx<NNN>.<css|js>". Inside this CSS
        // 3 levels up ("../../").
            exportContext.setDocParentLevels(2);
CVE-2022-23622 (Other, published 2022-02-09T22:15Z)
Description: value: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions there is a cross site scripting (XSS) vector in the `registerinline.vm` template related to the `xredirect` hidden field. This template is only used in the following conditions: 1. The wiki must be open to registration for anyone. 2. The wiki must be closed to view for Guest users or more specifically the XWiki.Registration page must be forbidden in View for guest user. A way to obtain the second condition is when administrators checked the "Prevent unregistered users from viewing pages, regardless of the page rights" box in the administration rights. This issue is patched in versions 12.10.11, 14.0-rc-1, 13.4.7, 13.10.3. There are two main ways for protecting against this vulnerability, the easiest and the best one is by applying a patch in the `registerinline.vm` template, the patch consists in checking the value of the xredirect field to ensure it matches: `<input type="hidden" name="xredirect" value="$escapetool.xml($!request.xredirect)" />`. If for some reason it's not possible to patch this file, another workaround is to ensure "Prevent unregistered users from viewing pages, regardless of the page rights" is not checked in the rights and apply a better right scheme using groups and rights on spaces.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/xwiki/xwiki-platform
Files changed:
xwiki-platform-core/xwiki-platform-web/xwiki-platform-web-templates/src/main/resources/templates/registerinline.vm
Commit message: XWIKI-19291: redirect parameter is badly handled in register page

  * Fix the typo


Vulnerable code:
        <input type="hidden" name="xredirect" value="$!request.xredirect" />

Fixed code:
        <input type="hidden" name="xredirect" value="$escapetool.xml($!request.xredirect)" />
CVE-2022-29161 (Java, published 2022-05-06T00:15Z)
Description: value: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The XWiki Crypto API will generate X509 certificates signed by default using SHA1 with RSA, which is not considered safe anymore for use in certificate signatures, due to the risk of collisions with SHA1. The problem has been patched in XWiki version 13.10.6, 14.3.1 and 14.4-rc-1. Since then, the Crypto API will generate X509 certificates signed by default using SHA256 with RSA. Administrators are advised to upgrade their XWiki installation to one of the patched versions. If the upgrade is not possible, it is possible to patch the module xwiki-platform-crypto in a local installation by applying the change exposed in 26728f3 and re-compiling the module.
Severity: MEDIUM (CVSS v3 base score: 9.8)
Weakness: CWE-326 \u2014 Inadequate Encryption Strength
The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.
Repository: https://github.com/xwiki/xwiki-platform
Files changed:
xwiki-platform-core/xwiki-platform-crypto/xwiki-platform-crypto-script/src/main/java/org/xwiki/crypto/script/RSACryptoScriptService.java
Commit message: XWIKI-19676: Update the RSA Crypto script service to use SHA256 instead of SHA1 for certificate signature


Vulnerable code:
    @Named("SHA1withRSAEncryption")

Fixed code:
    @Named("SHA256withRSAEncryption")
CVE-2022-29251 (XML, published 2022-05-25T21:15Z)
Description: value: XWiki Platform Flamingo Theme UI is a tool that allows customization and preview of any Flamingo-based skin. Starting with versions 6.2.4 and 6.3-rc-1, a possible cross-site scripting vector is present in the `FlamingoThemesCode.WebHomeSheet` wiki page related to the "newThemeName" form field. The issue is patched in versions 12.10.11, 14.0-rc-1, 13.4.7, and 13.10.3. The easiest available workaround is to edit the wiki page `FlamingoThemesCode.WebHomeSheet` (with wiki editor) according to the suggestion provided in the GitHub Security Advisory.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/xwiki/xwiki-platform
Files changed:
xwiki-platform-core/xwiki-platform-flamingo/xwiki-platform-flamingo-theme/xwiki-platform-flamingo-theme-ui/src/main/resources/FlamingoThemesCode/WebHomeSheet.xml
Commit message: XWIKI-19294: Fix bad escaping


Vulnerable code:
        &lt;input type="hidden" name="newThemeName" id="newThemeName" value="$request.newThemeName" /&gt;

Fixed code:
        &lt;input type="hidden" name="newThemeName" id="newThemeName" value="$escapetool.xml($request.newThemeName)" /&gt;
CVE-2022-29252 (XML, published 2022-05-25T21:15Z)
Description: value: XWiki Platform Wiki UI Main Wiki is a package for managing subwikis. Starting with version 5.3-milestone-2, XWiki Platform Wiki UI Main Wiki contains a possible cross-site scripting vector in the `WikiManager.JoinWiki ` wiki page related to the "requestJoin" field. The issue is patched in versions 12.10.11, 14.0-rc-1, 13.4.7, and 13.10.3. The easiest available workaround is to edit the wiki page `WikiManager.JoinWiki` (with wiki editor) according to the suggestion provided in the GitHub Security Advisory.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/xwiki/xwiki-platform
Files changed:
xwiki-platform-core/xwiki-platform-wiki/xwiki-platform-wiki-ui/xwiki-platform-wiki-ui-mainwiki/src/main/resources/WikiManager/JoinWiki.xml
Commit message: XWIKI-19292: Fix bad escaping


Vulnerable code:
                &lt;input type='hidden' name='requestJoin' value="$!request.requestJoin"/&gt;

Fixed code:
                &lt;input type='hidden' name='requestJoin' value="$escapetool.xml($!request.requestJoin)"/&gt;
CVE-2022-29253 (Java, published 2022-05-25T21:15Z)
Description: value: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting with version 8.3-rc-1 and prior to versions 12.10.3 and 14.0, one can ask for any file located in the classloader using the template API and a path with ".." in it. The issue is patched in versions 14.0 and 13.10.3. There is no easy workaround for this issue.
Severity: MEDIUM (CVSS v3 base score: 2.7)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/xwiki/xwiki-platform
Files changed:
xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/internal/skin/AbstractResourceSkin.java
xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/internal/template/InternalTemplateManager.java
Commit message: XWIKI-19349: Bad handling of classloader templates path resolution


Vulnerable code:
        // Prevent inclusion of templates from other directories
    private Template getClassloaderTemplate(String suffixPath, String templateName)
        return getClassloaderTemplate(Thread.currentThread().getContextClassLoader(), suffixPath, templateName);
    private Template getClassloaderTemplate(ClassLoader classloader, String suffixPath, String templateName)
        String templatePath = suffixPath + templateName;

Fixed code:
        // Prevent access to resources from other directories
import java.nio.file.Path;
import java.nio.file.Paths;
    private Template getClassloaderTemplate(String prefixPath, String templateName)
        return getClassloaderTemplate(Thread.currentThread().getContextClassLoader(), prefixPath, templateName);
    private Template getClassloaderTemplate(ClassLoader classloader, String prefixPath, String templateName)
        String templatePath = prefixPath + templateName;

        // Prevent access to resources from other directories
        Path normalizedResource = Paths.get(templatePath).normalize();
        // Protect against directory attacks.
        if (!normalizedResource.startsWith(prefixPath)) {
            this.logger.warn("Direct access to skin file [{}] refused. Possible break-in attempt!", normalizedResource);

            return null;
        }