Simon Urli

The issue allows pages to gain script or programming rights when they contain a link and the target of the link is renamed or moved, potentially leading to the execution of scripts contained in xobjects that should not have been executed.

The issue allows access to the hash of a password by using the diff feature of the history whenever the object storing the password is deleted. An attacker with rights to edit a user's page can exploit this to access the hash password of a user. This vulnerability is normally prevented on user profiles by default, except for users with Admin rights. It also impacts extensions that use passwords stored in xobjects, depending on the rights of those pages. There is no way to be 100% sure if this vulnerability has been exploited, as an attacker with enough privileges could have deleted the revision where the xobject was deleted after rolling back the deletion.

The issue is related to insufficient authentication checks for executed requests in the XWiki Platform, allowing cross-site request forgery. This can lead to remote code execution through script macros when a user with programming rights interacts with the platform, impacting the integrity, availability, and confidentiality of the XWiki installation. For regular cookie-based authentication, the issue is mitigated by SameSite cookie restrictions, but these are not enabled by default in Firefox and Safari as of March 2023.

The XWiki Platform is vulnerable to a cross-site scripting (XSS) attack, allowing users to inject JavaScript into a page by forging a URL with a payload. This can be exploited using the deletespace template, for example, by using a URL such as "xwiki/bin/deletespace/Sandbox/?xredirect=javascript:alert(document.domain)". The vulnerability exists since XWiki 3.4-milestone-1.

The issue allows users to forge a URL with a payload that injects Javascript into the page, enabling a cross-site scripting (XSS) attack. This can be exploited using the DeleteApplication page. For example, a URL such as "xwiki/bin/view/AppWithinMinutes/DeleteApplication?appName=Menu&resolve=true&xredirect=javascript:alert(document.domain)" can be used. The vulnerability exists due to the lack of measures to neutralize alternative XSS syntax.

The XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to break many translations coming from wiki pages by creating a corrupted document containing a translation object, leading to a broken page.

The issue is related to missing authorization in the `setDisabledStatus` method of the `User` class, allowing users with only Script rights to enable or disable other users. This operation should be restricted to users with admin rights.

The issue allows simple users to create global SSX/JSX without specific rights. In theory, only users with Programming Rights should be allowed to create SSX or JSX that are executed everywhere on a wiki. However, a bug enables anyone with edit rights to create those.

The issue is related to a cross-site scripting (XSS) vector in the `registerinline.vm` template, specifically with the `xredirect` hidden field. This template is used when the wiki is open to registration for anyone and closed to view for Guest users, or when the XWiki.Registration page is forbidden in View for guest users. Administrators can obtain the second condition by checking the "Prevent unregistered users from viewing pages, regardless of the page rights" box in the administration rights.

It is possible to determine if a user has an account in a wiki related to an email address and which username(s) is tied to that email by forging a request to the "Forgot username" page. This is due to the lack of a CSRF check on this page, making it easy to perform multiple requests.

The reset password form reveals the email address of users just by giving their username. The problem has been patched on XWiki 13.2RC1.

A vulnerability exists in the XWiki Platform where the script service method used to reset the authentication failures record can be executed by any user with Script rights, without requiring Programming rights. This allows an attacker with script rights to potentially perform a brute force attack by resetting the authentication failure record, effectively deactivating the mechanism meant to mitigate such attacks.

The XWiki Platform, specifically with the Ratings API installed, exposes an API that allows performing SQL requests without properly escaping the `from` and `where` search arguments. This could lead to SQL script injection for users with Script rights on XWiki.