Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.xwiki.platform:xwiki-platform-administration-ui

11 known vulnerabilities (8 critical, 2 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
11 · 8 critical, 2 high, 1 medium
Registry
Maven Central

Advisories 11

  • CVE-2024-55879Critical 9.1

    XWiki allows RCE from script right in configurable sections

    Affected: from 2.3, fixed in 15.10.9; from 16.0.0-rc-1, fixed in 16.3.0.

  • CVE-2024-21650Critical 10.0

    XWiki Remote Code Execution vulnerability via user registration

    Affected: from 2.2, fixed in 14.10.17; from 15.0-rc-1, fixed in 15.5.3; from 15.6-rc-1, fixed in 15.8-rc-1.

  • CVE-2023-50723Critical 10.0

    XWiki Platform remote code execution/programming rights with configuration section from any user account

    Affected: from 2.3, fixed in 14.10.15; from 15.0-rc-1, fixed in 15.5.2; from 15.6-rc-1, fixed in 15.7-rc-1.

  • CVE-2023-50722Critical 9.7

    XWiki Platform XSS/CSRF Remote Code Execution in XWiki.ConfigurableClass

    Affected: from 2.3, fixed in 14.10.15; from 15.0-rc-1, fixed in 15.5.2; from 15.6-rc-1, fixed in 15.7-rc-1.

  • CVE-2023-46731Critical 10.0

    Remote code execution through the section parameter in Administration as guest in XWiki Platform

    Affected: fixed in 14.10.14; from 15.0-rc-1, fixed in 15.5.1.

  • CVE-2023-29514Critical 10.0

    Code injection in template provider administration in xwiki-platform

    Affected: from 4.2-milestone-1, fixed in 13.10.11; from 14.0-rc-1, fixed in 14.4.8; from 14.5, fixed in 14.10.1.

  • CVE-2023-29510Critical 10.0

    Code injection via unescaped translations in xwiki-platform

    Affected: from 4.3-milestone-2, fixed in 14.10.2.

  • CVE-2023-29511Critical 9.9

    xwiki-platform-administration-ui vulnerable to privilege escalation

    Affected: from 1.5M2, fixed in 13.10.11; from 14.0-rc-1, fixed in 14.4.8; from 14.5, fixed in 14.10.1.

  • Remote code execution in xwiki-platform

    Affected: from 3.1-milestone-1, fixed in 13.1RC1.

  • Cross-Site Request Forgery in xwiki-platform

    Affected: fixed in 12.10.5; from 13.0, fixed in 13.2RC1.

  • CVE-2021-32730Medium 5.7

    No CSRF protection on the password change form

    Affected: fixed in 12.10.5; from 13.0, fixed in 13.2.