hitoshura25/cvefixes huggingface dataset:
CVE-2023-32071 (Other, published 2023-05-09T16:15Z)
Description: value: XWiki Platform is a generic wiki platform. Starting in versions 2.2-milestone-1 and prior to versions 14.4.8, 14.10.4, and 15.0-rc-1, it's possible to execute javascript with the right of any user by leading him to a special URL on the wiki targeting a page which contains an attachment. This has been patched in XWiki 15.0-rc-1, 14.10.4, and 14.4.8. The easiest possible workaround is to edit file `<xwiki app>/templates/importinline.vm` and apply the modification described in commit 28905f7f518cc6f21ea61fe37e9e1ed97ef36f01.
Severity: nan (CVSS v3 base score: 9)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/xwiki/xwiki-platform
Files changed:
xwiki-platform-core/xwiki-platform-web/xwiki-platform-web-templates/src/main/resources/templates/importinline.vm
Commit message: XWIKI-20340: Improve import escaping


Vulnerable code:
  #set($baseQueryString = "editor=$!{request.editor}&amp;section=$!{request.section}")

Fixed code:
  #set($baseQueryString = "editor=$!{escapetool.url($request.editor)}&amp;section=$!{escapetool.url($request.section)}")
CVE-2023-35156 (Other, published 2023-06-23T19:15Z)
Description: value: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). It's possible to exploit the delete template to perform a XSS, e.g. by using URL such as: > xwiki/bin/get/FlamingoThemes/Cerulean?xpage=xpart&vm=delete.vm&xredirect=javascript:alert(document.domain). This vulnerability exists since XWiki 6.0-rc-1. The vulnerability has been patched in XWiki 14.10.6 and 15.1. Note that a partial patch has been provided in 14.10.5 but wasn't enough to entirely fix the vulnerability. 

Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/xwiki/xwiki-platform
Files changed:
xwiki-platform-core/xwiki-platform-flamingo/xwiki-platform-flamingo-skin/xwiki-platform-flamingo-skin-resources/src/main/resources/flamingo/delete.vm
Commit message: XWIKI-20672: Sanitize template URLs


Vulnerable code:
    #set($cancelUrl = "$request.xredirect")
    #set($cancelUrl = $doc.getURL())

Fixed code:
    #getSanitizedURLAttributeValue('a','href',$request.xredirect,$doc.getURL(),$cancelUrl)
    #set($cancelUrl = $escapetool.xml($doc.getURL()))
CVE-2023-35156 (Other, published 2023-06-23T19:15Z)
Description: value: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). It's possible to exploit the delete template to perform a XSS, e.g. by using URL such as: > xwiki/bin/get/FlamingoThemes/Cerulean?xpage=xpart&vm=delete.vm&xredirect=javascript:alert(document.domain). This vulnerability exists since XWiki 6.0-rc-1. The vulnerability has been patched in XWiki 14.10.6 and 15.1. Note that a partial patch has been provided in 14.10.5 but wasn't enough to entirely fix the vulnerability. 

Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/xwiki/xwiki-platform
Files changed:
xwiki-platform-core/xwiki-platform-flamingo/xwiki-platform-flamingo-skin/xwiki-platform-flamingo-skin-resources/src/main/resources/flamingo/delete.vm
Commit message: XWIKI-20341: Sanitize template URLs


Vulnerable code:
        #set($cancelUrl = "$request.xredirect")
        #set($cancelUrl = $doc.getURL())
      <a class="btn btn-default" href="$!{escapetool.xml(${cancelUrl})}">$services.localization.render('no')</a>

Fixed code:
        #getSanitizedURLAttributeValue('a','href',$request.xredirect,$doc.getURL(),$cancelUrl)
        #set($cancelUrl = $escapetool.xml($doc.getURL()))
      <a class="btn btn-default" href="$cancelUrl">$services.localization.render('no')</a>
CVE-2023-35156 (Other, published 2023-06-23T19:15Z)
Description: value: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). It's possible to exploit the delete template to perform a XSS, e.g. by using URL such as: > xwiki/bin/get/FlamingoThemes/Cerulean?xpage=xpart&vm=delete.vm&xredirect=javascript:alert(document.domain). This vulnerability exists since XWiki 6.0-rc-1. The vulnerability has been patched in XWiki 14.10.6 and 15.1. Note that a partial patch has been provided in 14.10.5 but wasn't enough to entirely fix the vulnerability. 

Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/xwiki/xwiki-platform
Files changed:
xwiki-platform-core/xwiki-platform-flamingo/xwiki-platform-flamingo-skin/xwiki-platform-flamingo-skin-resources/src/main/resources/flamingo/delete.vm
Commit message: XWIKI-20672: Sanitize template URLs

  * Fix mistake


Vulnerable code:
  <a class="btn btn-default cancel" href="$!{escapetool.xml(${cancelUrl})}">$escapetool.xml($services.localization.render('cancel'))</a>

Fixed code:
  <a class="btn btn-default cancel" href="${cancelUrl}">$escapetool.xml($services.localization.render('cancel'))</a>
CVE-2023-35158 (Other, published 2023-06-23T19:15Z)
Description: value: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). It's possible to exploit the restore template to perform a XSS, e.g. by using URL such as: > /xwiki/bin/view/XWiki/Main?xpage=restore&showBatch=true&xredirect=javascript:alert(document.domain). This vulnerability exists since XWiki 9.4-rc-1. The vulnerability has been patched in XWiki 14.10.5 and 15.1-rc-1. 
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-87 \u2014 Improper Neutralization of Alternate XSS Syntax
The product does not neutralize or incorrectly neutralizes user-controlled input for alternate script syntax.
Repository: https://github.com/xwiki/xwiki-platform
Files changed:
xwiki-platform-core/xwiki-platform-flamingo/xwiki-platform-flamingo-skin/xwiki-platform-flamingo-skin-resources/src/main/resources/flamingo/restore.vm
Commit message: XWIKI-20352: Sanitize template URLs


Vulnerable code:
    #set($cancelUrl = "$request.xredirect")
    #set($cancelUrl = $doc.getURL())
  <a class="btn btn-default" href="$!{escapetool.xml(${cancelUrl})}">$services.localization.render('core.restore.confirm.no')</a>

Fixed code:
    #getSanitizedURLAttributeValue('a','href',$request.xredirect,$doc.getURL(),$cancelUrl)
    #set($cancelUrl = $escapetool.xml($doc.getURL()))
  <a class="btn btn-default" href="$cancelUrl">$services.localization.render('core.restore.confirm.no')</a>
CVE-2023-35159 (Other, published 2023-06-23T19:15Z)
Description: value: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). It's possible to exploit the deletespace template to perform a XSS, e.g. by using URL such as: > xwiki/bin/deletespace/Sandbox/?xredirect=javascript:alert(document.domain). This vulnerability exists since XWiki 3.4-milestone-1. The vulnerability has been patched in XWiki 14.10.5 and 15.1-rc-1.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/xwiki/xwiki-platform
Files changed:
xwiki-platform-core/xwiki-platform-web/xwiki-platform-web-templates/src/main/resources/templates/deletespace.vm
Commit message: XWIKI-20612: Sanitize template URLs


Vulnerable code:
      #set ($cancelURL = $request.xredirect)

Fixed code:
      ## We don't sanitize this as it will be handled by the server
      #getSanitizedURLAttributeValue('a','href',$request.xredirect,$doc.getURL(),$cancelURL)
CVE-2023-35160 (Other, published 2023-06-23T19:15Z)
Description: value: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). It's possible to exploit the resubmit template to perform a XSS, e.g. by using URL such as: > xwiki/bin/view/XWiki/Main xpage=resubmit&resubmit=javascript:alert(document.domain)&xback=javascript:alert(document.domain). This vulnerability exists since XWiki 2.5-milestone-2. The vulnerability has been patched in XWiki 14.10.5 and 15.1-rc-1.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/xwiki/xwiki-platform
Files changed:
xwiki-platform-core/xwiki-platform-web/xwiki-platform-web-templates/src/main/resources/templates/resubmit.vm
Commit message: XWIKI-20343: Sanitize template URLs


Vulnerable code:
#set($resubmit = "$!{escapetool.xml($request.getParameter('resubmit'))}")
#set($xback = "$!{escapetool.xml($request.getParameter('xback'))}")

Fixed code:
#getSanitizedURLAttributeValue('form','action', $request.getParameter('resubmit'), '', $resubmit)
#getSanitizedURLAttributeValue('a','href', $request.getParameter('xback'), $doc.getURL(), $xback)
CVE-2023-35161 (XML, published 2023-06-23T19:15Z)
Description: value: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). It's possible to exploit the DeleteApplication page to perform a XSS, e.g. by using URL such as: > xwiki/bin/view/AppWithinMinutes/DeleteApplication?appName=Menu&resolve=true&xredirect=javascript:alert(document.domain). This vulnerability exists since XWiki 6.2-milestone-1. The vulnerability has been patched in XWiki 14.10.5 and 15.1-rc-1.

Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/xwiki/xwiki-platform
Files changed:
xwiki-platform-core/xwiki-platform-appwithinminutes/xwiki-platform-appwithinminutes-ui/src/main/resources/AppWithinMinutes/DeleteApplication.xml
Commit message: XWIKI-20614: Sanitize template URLs


Vulnerable code:
    #set ($cancelURL = $request.xredirect)
    #set ($confirmParams.xredirect = $cancelURL)

Fixed code:
    #getSanitizedURLAttributeValue('a','href',$request.xredirect,$doc.getURL(),$cancelURL)
    ## We don't sanitize those parameters as the sanitation will be handled server side.
    #set ($confirmParams.xredirect = $request.xredirect)
CVE-2023-35162 (Other, published 2023-06-23T19:15Z)
Description: value: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). It's possible to exploit the previewactions template to perform a XSS, e.g. by using URL such as: > <hostname>/xwiki/bin/get/FlamingoThemes/Cerulean xpage=xpart&vm=previewactions.vm&xcontinue=javascript:alert(document.domain). This vulnerability exists since XWiki 6.1-rc-1. The vulnerability has been patched in XWiki 14.10.5 and 15.1-rc-1.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/xwiki/xwiki-platform
Files changed:
xwiki-platform-core/xwiki-platform-flamingo/xwiki-platform-flamingo-skin/xwiki-platform-flamingo-skin-resources/src/main/resources/flamingo/previewactions.vm
Commit message: XWIKI-20342: Sanitize template URLs


Vulnerable code:
<form id="backtoedit" class="buttons" action="$!{escapetool.xml($editorUrl)}" method="post">

Fixed code:
  ## We use the wiki editor as fallback url since it's the one supposed to work in all conditions.
  #set ($fallbackUrl = $tdoc.getURL("edit", "editor=wiki&amp;$docvariant"))
  #getSanitizedURLAttributeValue('form','action',$editorUrl, $fallbackUrl, $finalEditorUrl)
<form id="backtoedit" class="buttons" action="$finalEditorUrl" method="post">
CVE-2023-46244 (XML, published 2023-11-07T19:15Z)
Description: value: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible for a user to write a script in which any velocity content is executed with the right of any other document content author. Since this API require programming right and the user does not have it, the expected result is `$doc.document.authors.contentAuthor` (not executed script), unfortunately with the security vulnerability it is possible for the attacker to get `XWiki.superadmin` which shows that the title was executed with the right of the unmodified document. This has been patched in XWiki versions 14.10.7 and 15.2RC1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-863 \u2014 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
Repository: https://github.com/xwiki/xwiki-platform
Files changed:
xwiki-platform-core/xwiki-platform-index/xwiki-platform-index-tree/xwiki-platform-index-tree-macro/src/main/resources/XWiki/DocumentTreeMacros.xml
Commit message: XWIKI-20625: Improve document title display in the document tree


Vulnerable code:
    ## Make sure the displayed title is not affected by the sheet request parameter (e.g. when $translatedDocument is
    ## the current document). By setting the title (even if we don't change it) the internal document instance is cloned
    ## so it's going to be different than the current document instance (which is the target of the sheet parameter).
    #set ($discard = $translatedDocument.setTitle($translatedDocument.title))

Fixed code:
CVE-2023-46732 (Other, published 2023-11-06T19:15Z)
Description: value: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki is vulnerable to reflected cross-site scripting (RXSS) via the `rev` parameter that is used in the content of the content menu without escaping. If an attacker can convince a user to visit a link with a crafted parameter, this allows the attacker to execute arbitrary actions in the name of the user, including remote code (Groovy) execution in the case of a user with programming right, compromising the confidentiality, integrity and availability of the whole XWiki installation. This has been patched in XWiki 15.6 RC1, 15.5.1 and 14.10.14. The patch in commit `04e325d57` can be manually applied without upgrading (or restarting) the instance. Users are advised to upgrade or to manually apply the patch. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/xwiki/xwiki-platform
Files changed:
xwiki-platform-core/xwiki-platform-flamingo/xwiki-platform-flamingo-skin/xwiki-platform-flamingo-skin-resources/src/main/resources/flamingo/menus_content.vm
Commit message: XWIKI-21095: Improve revision handling in code viewer menu item


Vulnerable code:
          #set ($revisionParameter = "&rev=$request.rev")

Fixed code:
          #set ($revisionParameter = "&rev=$escapetool.url($request.rev)")
CVE-2023-50723 (XML, published 2023-12-15T19:15Z)
Description: value: XWiki Platform is a generic wiki platform. Starting in 2.3 and prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, anyone who can edit an arbitrary wiki page in an XWiki installation can gain programming right through several cases of missing escaping in the code for displaying sections in the administration interface. This impacts the confidentiality, integrity and availability of the whole XWiki installation. Normally, all users are allowed to edit their own user profile so this should be exploitable by all users of the XWiki instance. This has been fixed in XWiki 14.10.15, 15.5.2 and 15.7RC1. The patches can be manually applied to the `XWiki.ConfigurableClassMacros` and `XWiki.ConfigurableClass` pages.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/xwiki/xwiki-platform
Files changed:
xwiki-platform-core/xwiki-platform-administration/xwiki-platform-administration-ui/src/main/resources/XWiki/ConfigurableClass.xml
Commit message: XWIKI-21194: Improve escaping of error message in ConfigurableClass


Vulnerable code:
                  {{translation key="xe.admin.configurable.noObjectOfConfigurationClassFound" parameters="$objClass.getName(), $app.getFullName()"/}}

Fixed code:
                  #set($escapedObjClassName =
                    $services.rendering.escape($escapetool.java($objClass.getName()), 'xwiki/2.1'))
                  #set($translationEscapedAppName =
                    $services.rendering.escape($escapetool.java($app.getFullName()), 'xwiki/2.1'))
                  {{translation key="xe.admin.configurable.noObjectOfConfigurationClassFound"
                    parameters="~"$escapedObjClassName~", ~"$translationEscapedAppName~""/}}
CVE-2023-50732 (XML, published 2023-12-21T20:15Z)
Description: value: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to execute a Velocity script without script right through the document tree. This has been patched in XWiki 14.10.7 and 15.2RC1.
Severity: nan (CVSS v3 base score: 6.3)
Weakness: CWE-863 \u2014 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
Repository: https://github.com/xwiki/xwiki-platform
Files changed:
xwiki-platform-core/xwiki-platform-index/xwiki-platform-index-tree/xwiki-platform-index-tree-macro/src/main/resources/XWiki/DocumentTreeMacros.xml
Commit message: XWIKI-20625: Improve document title display in the document tree


Vulnerable code:
    ## Make sure the displayed title is not affected by the sheet request parameter (e.g. when $translatedDocument is
    ## the current document). By setting the title (even if we don't change it) the internal document instance is cloned
    ## so it's going to be different than the current document instance (which is the target of the sheet parameter).
    #set ($discard = $translatedDocument.setTitle($translatedDocument.title))

Fixed code:
CVE-2024-31464 (Java, published 2024-04-10T19:15Z)
Description: value: XWiki Platform is a generic wiki platform. Starting in version 5.0-rc-1 and prior to versions 14.10.19, 15.5.4, and 15.9-rc-1, it is possible to access the hash of a password by using the diff feature of the history whenever the object storing the password is deleted. Using that vulnerability it's possible for an attacker to have access to the hash password of a user if they have rights to edit the users' page.  With the default right scheme in XWiki this vulnerability is normally prevented on user profiles, except by users with Admin rights. Note that this vulnerability also impacts any extensions that might use passwords stored in xobjects: for those usecases it depends on the right of those pages. There is currently no way to be 100% sure that this vulnerability has been exploited, as an attacker with enough privilege could have deleted the revision where the xobject was deleted after rolling-back the deletion. But again, this operation requires high privileges on the target page (Admin right). A page with a user password xobject which have in its history a revision where the object has been deleted should be considered at risk and the password should be changed there. a diff, to ensure it's not coming from a password field. As another mitigation, admins should ensure that the user pages are properly protected: the edit right shouldn't be allowed for other users than Admin and owner of the profile (which is the default right). There is not much workaround possible for a privileged user other than upgrading XWiki.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/xwiki/xwiki-platform
Files changed:
xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/doc/XWikiDocument.java
xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/objects/BaseObject.java
Commit message: XWIKI-19948: Bad diff information when xobject is deleted (#2439)

  * Ensure to retrieve the xclass even when the xobject has been deleted
  * Ensure the BaseObject contains an XClass reference when creating it
    in XWikiDocument#getObjectDiff

Vulnerable code:
                        dlist = new BaseObject().getDiff(originalObj, context);

Fixed code:
                        newObj = new BaseObject();
                        // We want the xclass reference to be set so that it can resolve the xclass properties.
                        newObj.setXClassReference(originalObj.getXClassReference());
                        dlist = newObj.getDiff(originalObj, context);
            // Bulletproofing: in theory the BaseObject is defined with a xclass reference allowing to resolve it
            // however, it's possible that the reference is not set, in which case we might still find the info
            // in the old object.
            if (bclass == null) {
                bclass = oldObject.getXClass(context);
            }