Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.xwiki.platform:xwiki-platform-oldcore

46 known vulnerabilities (14 critical, 15 high, 15 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
46 · 14 critical, 15 high, 15 medium, 1 low
Registry
Maven Central

Advisories 46

  • XWiki Platform: Resource path traversal via /skin/ action endpoint in Jetty 12+

    Affected: fixed in 17.10.5; from 18.0.0-rc-1, fixed in 18.2.0.

  • CVE-2026-40104Medium 6.9

    XWiki's REST APIs can list all pages/spaces, leading to unavailability

    Affected: from 1.8-rc-1, fixed in 16.10.16; from 17.0.0-rc-1, fixed in 17.4.8; from 17.5.0-rc-1, fixed in 17.10.1.

  • XWiki Platform affected by remote code execution with script right through unprotected Velocity scripting API

    Affected: from 17.0.0-rc-1, fixed in 17.4.8; from 17.5.0-rc-1, fixed in 17.10.1.

  • XWiki Platform: Password and email exposure in xml.vm fields

    Affected: from 1.1, fixed in 16.4.7; from 16.5.0-rc-1, fixed in 16.10.5; from 17.0.0-rc-1, fixed in 17.2.0-rc-1.

  • XWiki Platform: Any user with editing rights can access password properties through Database List Properties

    Affected: from 9.8-rc-1, fixed in 16.4.7; from 16.5.0-rc-1, fixed in 16.10.5; from 17.0.0-rc-1, fixed in 17.2.0-rc-1.

  • XWiki Platform's searchDocuments API allows for SQL injection

    Affected: from 1.0, fixed in 16.10.6; from 17.0.0-rc1, fixed in 17.3.0-rc-1.

  • XWiki allows remote code execution through preview of XClass changes in AWM editor

    Affected: from 7.2-milestone-2, fixed in 16.4.7; from 16.5.0-rc-1, fixed in 16.10.3; from 17.0.0-rc-1, fixed in 17.0.0.

  • CVE-2024-56158Critical 9.3

    XWiki allows SQL injection in query endpoint of REST API with Oracle

    Affected: from 1.0, fixed in 15.10.16; from 16.0.0-rc-1, fixed in 16.4.7; from 16.5.0-rc-1, fixed in 16.10.2.

  • org.xwiki.platform:xwiki-platform-oldcore allows SQL injection in short form select requests through the script query API

    Affected: from 1.6-milestone-1, fixed in 15.10.16; from 16.0.0-rc-1, fixed in 16.4.6; from 16.5.0-rc-1, fixed in 16.10.1.

  • CVE-2024-43400Critical 9.1

    XWiki Platform allows XSS through XClass name in string properties

    Affected: from 1.1.2, fixed in 14.10.21; from 15.0-rc-1, fixed in 15.5.5; from 15.6-rc-1, fixed in 15.10.6; from 16.0.0-rc-1, fixed in 16.0.0.

  • CVE-2024-37898Medium 4.3

    XWiki Platform vulnerable to document deletion and overwrite from edit

    Affected: from 13.10.4, fixed in 14.10.21; from 14.2, fixed in 14.10.21; from 15.0, fixed in 15.5.5; from 15.6-rc-1, fixed in 15.10.6.

  • CVE-2024-37899Critical 9.1

    Disabling a user account changes its author, allowing RCE from user account in XWiki

    Affected: from 13.4.7, fixed in 14.10.21; from 13.10.3, fixed in 14.10.21; from 15.0-rc-1, fixed in 15.5.5; from 15.6-rc-1, fixed in 15.10.6; from 16.0.0-rc-1, fixed in 16.0.0.

  • CVE-2024-31987Critical 10.0

    XWiki Platform remote code execution from account via custom skins support

    Affected: from 6.4-milestone-1, fixed in 14.10.19; from 15.0-rc-1, fixed in 15.5.4; from 15.6-rc-1, fixed in 15.10-rc-1.

  • CVE-2024-31981Critical 10.0

    XWiki Platform: Privilege escalation (PR) from user registration through PDFClass

    Affected: from 3.0.1, fixed in 14.10.20; from 15.0-rc-1, fixed in 15.5.4; from 15.6-rc-1, fixed in 15.10-rc-1.

  • CVE-2024-31464Medium 6.8

    XWiki Platform: Password hash might be leaked by diff once the xobject holding them is deleted

    Affected: from 5.0-rc-1, fixed in 14.10.19; from 15.0-rc-1, fixed in 15.5.4; from 15.6-rc-1, fixed in 15.9-rc-1.

Show all 46 advisoriesShow fewer advisories

  • XWiki has no right protection on rollback action

    Affected: from 1.0, fixed in 14.10.17.

  • CVE-2023-46243Critical 10.0

    Code execution via the edit action in XWiki platform

    Affected: from 15.0, fixed in 15.2-rc-1; from 1.0, fixed in 14.10.6.

  • CVE-2023-46242Critical 9.7

    Code injection in XWiki Platform

    Affected: from 1.0, fixed in 14.10.7; from 15.0, fixed in 15.2-rc-1.

  • CVE-2023-37911Medium 6.5

    org.xwiki.platform:xwiki-platform-oldcore may leak data through deleted and re-created documents

    Affected: from 9.4-rc-1, fixed in 14.10.8; from 15.0-rc-1, fixed in 15.3-rc-1.

  • CVE-2023-41046Medium 6.3

    Velocity execution without script rights in Xwiki platform

    Affected: from 7.2, fixed in 14.10.10; from 15.0-rc-1, fixed in 15.4-rc-1.

  • CVE-2023-40572Critical 9.1

    XWiki Platform vulnerable to CSRF privilege escalation/RCE via the create action

    Affected: from 3.2-milestone-3, fixed in 14.10.9; from 15.0-rc-1, fixed in 15.4-rc-1.

  • CVE-2023-36468Critical 10.0

    Upgrading doesn't prevent exploiting vulnerable XWiki documents

    Affected: from 2.0, fixed in 14.10.7; from 15.0-rc-1, fixed in 15.2-rc-1.

  • XWiki Platform vulnerable to reflected cross-site scripting via delattachment action

    Affected: from 3.2-milestone-3, fixed in 14.10.6; from 15.0-rc-0, fixed in 15.1-rc-1.

  • CVE-2023-32068Medium 4.7

    URL Redirection to Untrusted Site in XWiki

    Affected: fixed in 14.10.4.

  • CVE-2023-29523Critical 10.0

    Code injection in display method used in user profiles in xwiki-platform

    Affected: from 3.3-milestone-1, fixed in 13.10.11; from 14.0-rc-1, fixed in 14.4.8; from 14.5, fixed in 14.10.2.

  • CVE-2023-29526Critical 10.0

    Async and display macro allow displaying and interacting with any document in restricted mode

    Affected: from 10.11.1, fixed in 13.10.11; from 14.0-rc-1, fixed in 14.4.8; from 14.5, fixed in 14.10.3.

  • CVE-2023-29507Critical 9.1

    org.xwiki.platform:xwiki-platform-oldcore makes Incorrect Use of Privileged APIs with DocumentAuthors

    Affected: from 14.5, fixed in 14.10; from 14.4.1, fixed in 14.4.7.

  • Data leak through deleted documents

    Affected: from 1.2-milestone-1, fixed in 13.10.11; from 14.0-rc-1, fixed in 14.4.7; from 14.5, fixed in 14.10.

  • CVE-2023-29204Medium 4.7

    URL Redirection to Untrusted Site ('Open Redirect') in org.xwiki.platform:xwiki-platform-oldcore

    Affected: from 6.0-rc-1, fixed in 13.10.10; from 14.0-rc-1, fixed in 14.4.4; from 14.5, fixed in 14.8-rc-1.

  • CVE-2023-26470Medium 5.7

    In XWiki Platform, saving a document with a large object number leads to persistent OOM errors

    Affected: fixed in 14.0-rc-1.

  • CVE-2023-26474Critical 10.0

    XWiki Platform vulnerable to privilege escalation via properties with wiki syntax that are executed with wrong author

    Affected: from 13.10, fixed in 13.10.11; from 14.0, fixed in 14.4.7; from 14.5, fixed in 14.10.

  • Creation of new database tables through login form on PostgreSQL

    Affected: fixed in 13.10.8; from 14.0.0, fixed in 14.4.2; from 14.5.0, fixed in 14.6-rc-1.

  • CVE-2022-41929Medium 4.9

    Missing Authorization in User#setDisabledStatus in org.xwiki.platform:xwiki-platform-oldcore

    Affected: from 11.7RC1, fixed in 13.10.7; from 14.0.0, fixed in 14.4.2.

  • XWiki Platform Old Core vulnerable to Authentication Bypass Using the Login Action

    Affected: fixed in 13.10.4; from 14.0, fixed in 14.2.

  • org.xwiki.platform:xwiki-platform-oldcore Improper Authorization check for inactive users

    Affected: from 1.1, fixed in 13.10.5; from 14.0, fixed in 14.3-rc-1.

  • XWiki.WebHome vulnerable to Improper Privilege Management in XWiki resolving groups

    Affected: from 11.3.7, fixed in 13.10.4; from 14.0-rc-1, fixed in 14.2-rc-1.

  • Path Traversal in XWiki Platform

    Affected: from 8.3-rc-1, fixed in 13.10.3.

  • CVE-2022-23621Medium 5.5

    Missing authorization in xwiki-platform

    Affected: from 13.6-rc-1, fixed in 13.7-rc-1; from 13.0.0, fixed in 13.4.3; fixed in 12.10.9.

  • CVE-2022-23618Medium 4.7

    Open Redirect in xwiki-platform

    Affected: fixed in 12.10.7; from 13.0.0, fixed in 13.3RC1.

  • CVE-2022-23617Medium 6.5

    Missing authorization in xwiki-platform

    Affected: fixed in 12.10.6; from 13.0, fixed in 13.2-rc-1.

  • CVE-2022-23615Medium 5.4

    Partial authorization bypass on document save in xwiki-platform

    Affected: from 1.0, fixed in 13.0.

  • CVE-2021-43841Medium 5.4

    XSS by SVG upload in xwiki-platform

    Affected: fixed in 12.10.6; from 13.0, fixed in 13.3RC1.

  • CVE-2021-29459Critical 9.6

    XSS Cross Site Scripting

    Affected: fixed in 12.6.3; from 12.6.4, fixed in 12.8.

  • RCE in XWiki

    Affected: fixed in 11.10.6; from 12.0, fixed in 12.5.

  • CVE-2020-15171Medium 6.6

    Users with SCRIPT rights can execute arbitrary code in XWiki

    Affected: fixed in 11.10.5; from 12.0.0, fixed in 12.2.1.

  • PreviewAction in XWiki 0.9.543 through 0.9.1252 does not set the Author field to the identity of the user who last modified a document…

    Affected: from 0.9.543, fixed in 1.0B1.