XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When an XWiki installation is upgraded and that upgrade contains a fix for a bug in a document, just a new version of that document is added. In some cases, it's still possible to exploit the vulnerability that was fixed in the new version. The severity of this depends on the fixed vulnerability, for the purpose of this advisory take CVE-2022-36100/GHSA-2g5c-228j-p52x as example - it is easily exploitable with just view rights and critical. When XWiki is upgraded from a version before the fix for it (e.g., 14.3) to a version including the fix (e.g., 14.4), the vulnerability can still be reproduced by adding rev=1.1 to the URL used in the reproduction steps so remote code execution is possible even after upgrading. Therefore, this affects the confidentiality, integrity and availability of the whole XWiki installation. This vulnerability also affects manually added script macros that contained security vulnerabilities that were later fixed by changing the script macro without deleting the versions with the security vulnerability from the history. This vulnerability doesn't affect freshly installed versions of XWiki. Further, this vulnerability doesn't affect content that is only loaded from the current version of a document like the code of wiki macros or UI extensions. This vulnerability has been patched in XWiki 14.10.7 and 15.2RC1 by forcing old revisions to be executed in a restricted mode that disables all script macros. As a workaround, admins can manually delete old revisions of affected documents. A script could be used to identify all installed documents and delete the history for them. However, also manually added and later corrected code may be affected by this vulnerability so it is easy to miss documents.
{
"cwe_ids": [
"CWE-459"
]
}[
{
"signature_version": "v1",
"deprecated": false,
"source": "https://github.com/xwiki/xwiki-platform/commit/15a6f845d8206b0ae97f37aa092ca43d4f9d6e59",
"signature_type": "Function",
"digest": {
"function_hash": "123012931957901159386271635118730394561",
"length": 1026.0
},
"target": {
"file": "xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/doc/XWikiDocument.java",
"function": "getRenderedContent"
},
"id": "CVE-2023-36468-0cf820ea"
},
{
"signature_version": "v1",
"deprecated": false,
"source": "https://github.com/xwiki/xwiki-platform/commit/15a6f845d8206b0ae97f37aa092ca43d4f9d6e59",
"signature_type": "Function",
"digest": {
"function_hash": "160160405259003427041546713035700682364",
"length": 822.0
},
"target": {
"file": "xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/test/MockitoOldcore.java",
"function": "answer"
},
"id": "CVE-2023-36468-19722334"
},
{
"signature_version": "v1",
"deprecated": false,
"source": "https://github.com/xwiki/xwiki-platform/commit/15a6f845d8206b0ae97f37aa092ca43d4f9d6e59",
"signature_type": "Function",
"digest": {
"function_hash": "151014050922768051271738333600267760967",
"length": 4477.0
},
"target": {
"file": "xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/internal/filter/output/XWikiDocumentOutputFilterStream.java",
"function": "begin"
},
"id": "CVE-2023-36468-2907eb4b"
},
{
"signature_version": "v1",
"deprecated": false,
"source": "https://github.com/xwiki/xwiki-platform/commit/15a6f845d8206b0ae97f37aa092ca43d4f9d6e59",
"signature_type": "Function",
"digest": {
"function_hash": "117241191672380593009985700614781731748",
"length": 1189.0
},
"target": {
"file": "xwiki-platform-core/xwiki-platform-rendering/xwiki-platform-rendering-macros/xwiki-platform-rendering-macro-context/src/main/java/org/xwiki/rendering/internal/macro/context/ContextMacro.java",
"function": "executeContext"
},
"id": "CVE-2023-36468-2b5ec310"
},
{
"signature_version": "v1",
"deprecated": false,
"source": "https://github.com/xwiki/xwiki-platform/commit/15a6f845d8206b0ae97f37aa092ca43d4f9d6e59",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"165737047896731952591398740596868003632",
"248014628566761961243329128864477175214",
"107645638728231906552752595657925241392"
]
},
"target": {
"file": "xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/api/Document.java"
},
"id": "CVE-2023-36468-2e58b632"
},
{
"signature_version": "v1",
"deprecated": false,
"source": "https://github.com/xwiki/xwiki-platform/commit/15a6f845d8206b0ae97f37aa092ca43d4f9d6e59",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"11186618680130022251980422728865612442",
"65907785793517837661353248417764002133",
"105831440734466122416451715014159428878",
"306724115626649495128444289630786633177",
"196795410936597505302558500361778139839",
"275845168785873056895209741585512318610",
"268354502149529704196109862417252577509",
"30977339825979467352738837975970283099"
]
},
"target": {
"file": "xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/test/MockitoOldcore.java"
},
"id": "CVE-2023-36468-3c273358"
},
{
"signature_version": "v1",
"deprecated": false,
"source": "https://github.com/xwiki/xwiki-platform/commit/15a6f845d8206b0ae97f37aa092ca43d4f9d6e59",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"94892792786231280984718675826325073515",
"179339668203633926153193056498787101462",
"183748276706536368215438840943880886424",
"276215921080780793884252793510886323487",
"285422989589527322863362068750325184759"
]
},
"target": {
"file": "xwiki-platform-core/xwiki-platform-flamingo/xwiki-platform-flamingo-skin/xwiki-platform-flamingo-skin-test/xwiki-platform-flamingo-skin-test-docker/src/test/it/org/xwiki/flamingo/test/docker/RecycleBinIT.java"
},
"id": "CVE-2023-36468-488eb937"
},
{
"signature_version": "v1",
"deprecated": false,
"source": "https://github.com/xwiki/xwiki-platform/commit/15a6f845d8206b0ae97f37aa092ca43d4f9d6e59",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"264033683949429958800248074546841419118",
"99214792101255290593708541505497686794",
"51368960850079307955713530240571866060",
"178140707997132195414451695380465038969"
]
},
"target": {
"file": "xwiki-platform-core/xwiki-platform-display/xwiki-platform-display-api/src/main/java/org/xwiki/display/internal/DocumentTitleDisplayer.java"
},
"id": "CVE-2023-36468-4a9a2649"
},
{
"signature_version": "v1",
"deprecated": false,
"source": "https://github.com/xwiki/xwiki-platform/commit/15a6f845d8206b0ae97f37aa092ca43d4f9d6e59",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"14913540256693838124276903845482110695",
"1435913143264401242258382326293251213",
"110548084207104606058080189277065059399",
"276349689069635117358273449202005620912",
"35516421483644163020434596869187394470",
"30769152403540310851951493676757340662",
"240522512309630831697827857464120036961",
"63023319149774050960125992398873200987"
]
},
"target": {
"file": "xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-authorization/xwiki-platform-security-authorization-bridge/src/main/java/org/xwiki/security/authorization/internal/DefaultContextualAuthorizationManager.java"
},
"id": "CVE-2023-36468-4c186b96"
},
{
"signature_version": "v1",
"deprecated": false,
"source": "https://github.com/xwiki/xwiki-platform/commit/15a6f845d8206b0ae97f37aa092ca43d4f9d6e59",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"127518713872964714802278020136239747598",
"119207925645227317550712105014139004505",
"259358982507095914919428925950779984718"
]
},
"target": {
"file": "xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/store/XWikiHibernateStore.java"
},
"id": "CVE-2023-36468-67137ffb"
},
{
"signature_version": "v1",
"deprecated": false,
"source": "https://github.com/xwiki/xwiki-platform/commit/15a6f845d8206b0ae97f37aa092ca43d4f9d6e59",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"201865577717211840354522732862000537402",
"43542091896794845018013848747321993927",
"140162269514413428415046327979006228776",
"283019178147221685204611140051562789104",
"286270939858214743620493049641482022089"
]
},
"target": {
"file": "xwiki-platform-core/xwiki-platform-display/xwiki-platform-display-api/src/main/java/org/xwiki/display/internal/AbstractDocumentTitleDisplayer.java"
},
"id": "CVE-2023-36468-706fce27"
},
{
"signature_version": "v1",
"deprecated": false,
"source": "https://github.com/xwiki/xwiki-platform/commit/15a6f845d8206b0ae97f37aa092ca43d4f9d6e59",
"signature_type": "Function",
"digest": {
"function_hash": "295596264533320453860739946061908717748",
"length": 918.0
},
"target": {
"file": "xwiki-platform-core/xwiki-platform-display/xwiki-platform-display-api/src/main/java/org/xwiki/display/internal/DocumentContentAsyncRenderer.java",
"function": "initialize"
},
"id": "CVE-2023-36468-7103dfda"
},
{
"signature_version": "v1",
"deprecated": false,
"source": "https://github.com/xwiki/xwiki-platform/commit/15a6f845d8206b0ae97f37aa092ca43d4f9d6e59",
"signature_type": "Function",
"digest": {
"function_hash": "62952301933468740369651235739760097267",
"length": 280.0
},
"target": {
"file": "xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-authorization/xwiki-platform-security-authorization-bridge/src/main/java/org/xwiki/security/authorization/internal/DefaultContextualAuthorizationManager.java",
"function": "checkPreAccess"
},
"id": "CVE-2023-36468-728cfc06"
},
{
"signature_version": "v1",
"deprecated": false,
"source": "https://github.com/xwiki/xwiki-platform/commit/15a6f845d8206b0ae97f37aa092ca43d4f9d6e59",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"98859517435743364604389940719898379134",
"292995809288970061146827229169371738089",
"100817951561585181024589711520071096629",
"291515602658615450373614294877940481375"
]
},
"target": {
"file": "xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/doc/XWikiDocumentMockitoTest.java"
},
"id": "CVE-2023-36468-98cbd5be"
},
{
"signature_version": "v1",
"deprecated": false,
"source": "https://github.com/xwiki/xwiki-platform/commit/15a6f845d8206b0ae97f37aa092ca43d4f9d6e59",
"signature_type": "Function",
"digest": {
"function_hash": "5882623875748102129255585023819243860",
"length": 4260.0
},
"target": {
"file": "xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/store/XWikiHibernateStore.java",
"function": "saveXWikiDoc"
},
"id": "CVE-2023-36468-a7261562"
},
{
"signature_version": "v1",
"deprecated": false,
"source": "https://github.com/xwiki/xwiki-platform/commit/15a6f845d8206b0ae97f37aa092ca43d4f9d6e59",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"130401822725851137789320397473894985301",
"34725046770161046334137969647694087249",
"287864767733029756660913459356284239010",
"212578078603152020452648298043414739061"
]
},
"target": {
"file": "xwiki-platform-core/xwiki-platform-rendering/xwiki-platform-rendering-macros/xwiki-platform-rendering-macro-context/src/main/java/org/xwiki/rendering/internal/macro/context/ContextMacro.java"
},
"id": "CVE-2023-36468-ace13fb4"
},
{
"signature_version": "v1",
"deprecated": false,
"source": "https://github.com/xwiki/xwiki-platform/commit/15a6f845d8206b0ae97f37aa092ca43d4f9d6e59",
"signature_type": "Function",
"digest": {
"function_hash": "201941822821309377611161590380513883914",
"length": 863.0
},
"target": {
"file": "xwiki-platform-core/xwiki-platform-display/xwiki-platform-display-api/src/main/java/org/xwiki/display/internal/DocumentTitleDisplayer.java",
"function": "extractTitleFromContent"
},
"id": "CVE-2023-36468-af586a7d"
},
{
"signature_version": "v1",
"deprecated": false,
"source": "https://github.com/xwiki/xwiki-platform/commit/15a6f845d8206b0ae97f37aa092ca43d4f9d6e59",
"signature_type": "Function",
"digest": {
"function_hash": "24155242699483066131350945147188805907",
"length": 1599.0
},
"target": {
"file": "xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/test/MockitoOldcore.java",
"function": "answer"
},
"id": "CVE-2023-36468-b6cc7983"
},
{
"signature_version": "v1",
"deprecated": false,
"source": "https://github.com/xwiki/xwiki-platform/commit/15a6f845d8206b0ae97f37aa092ca43d4f9d6e59",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"266980849952561426489491682152146681547",
"157755383342522050090306436053927844186"
]
},
"target": {
"file": "xwiki-platform-core/xwiki-platform-bridge/src/main/java/org/xwiki/bridge/DocumentModelBridge.java"
},
"id": "CVE-2023-36468-c2bca15d"
},
{
"signature_version": "v1",
"deprecated": false,
"source": "https://github.com/xwiki/xwiki-platform/commit/15a6f845d8206b0ae97f37aa092ca43d4f9d6e59",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"115378296012340835745044922829865144741",
"88080238438130108621392084430239430295",
"252627999116654882766805376604956039347"
]
},
"target": {
"file": "xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/internal/filter/output/XWikiDocumentOutputFilterStream.java"
},
"id": "CVE-2023-36468-c77e11e3"
},
{
"signature_version": "v1",
"deprecated": false,
"source": "https://github.com/xwiki/xwiki-platform/commit/15a6f845d8206b0ae97f37aa092ca43d4f9d6e59",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"149526161489386035581188106895891129585",
"24342047154901739722003595904464216543",
"77980161633803283055466433364462475535",
"262093554962131478694784951722372652296",
"80596636874674708133646410587510701812",
"88287684646919530506540650095155760542",
"275598344034553953219716165141278733817",
"141139979624943890481124993284762581747",
"190871278277279730469895447789262475764",
"142130735111428320663493934929159020662",
"219411354906959569191938045603138235894",
"271333773282779583458336839973577494010",
"318868123494405669719416064157641376913",
"270054411609288273734161547164067913215",
"117777046852041553977015006577290987483",
"168109781634927041319035126133052194308",
"63607505120170124613740669836974935246",
"102053326539283409476383000083948747911",
"200997938775481151635382836814854154256",
"207519090677936432580759363879928666551",
"38517424889925080876176426105368237525",
"53833407910069279830793435013945641226",
"101196528780908534402373160625424136912"
]
},
"target": {
"file": "xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-authorization/xwiki-platform-security-authorization-bridge/src/test/java/org/xwiki/security/authorization/internal/DefaultContextualAuthorizationManagerTest.java"
},
"id": "CVE-2023-36468-c98d68ca"
},
{
"signature_version": "v1",
"deprecated": false,
"source": "https://github.com/xwiki/xwiki-platform/commit/15a6f845d8206b0ae97f37aa092ca43d4f9d6e59",
"signature_type": "Function",
"digest": {
"function_hash": "313632101753341652536962517168137690568",
"length": 793.0
},
"target": {
"file": "xwiki-platform-core/xwiki-platform-display/xwiki-platform-display-api/src/main/java/org/xwiki/display/internal/AbstractDocumentTitleDisplayer.java",
"function": "displayTitle"
},
"id": "CVE-2023-36468-cd8b2d52"
},
{
"signature_version": "v1",
"deprecated": false,
"source": "https://github.com/xwiki/xwiki-platform/commit/15a6f845d8206b0ae97f37aa092ca43d4f9d6e59",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"298758962388330881826274825969241648064",
"284015289355979205348727918779567282720",
"235300765948803789125808197149084328071",
"236310101038178832373972375454513576075",
"179070925331217792050992586432821381554",
"38757504482287713363874624544621682304",
"106787884481877078586791773080880913281",
"323754778321723177491671865475785703610",
"114065041320961532354224894364447811351",
"4385708028378267392098971724499126632",
"92150554876734187715685601112293835189",
"84608578463645193812968742705413485567",
"261891860044941595544046390349801485644",
"47872315530633260522405734520369416556",
"16386599470301676164532208129522067237",
"177641845316655923666061779209816478963",
"238340557416363211881617889958912542170",
"186062284129466323384690005926319345157",
"194959886089009603335572805763878975877",
"282006238458206131697576767833007084000",
"232390920425899268001603356338636634962",
"129935182038533590613854105451648751425",
"23423024301075793717268991175351338991"
]
},
"target": {
"file": "xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/doc/XWikiDocumentRenderingTest.java"
},
"id": "CVE-2023-36468-d74cfef4"
},
{
"signature_version": "v1",
"deprecated": false,
"source": "https://github.com/xwiki/xwiki-platform/commit/15a6f845d8206b0ae97f37aa092ca43d4f9d6e59",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"285815744206201828250363665868992250501",
"309522695156018497754266106056667427646",
"201574621554033091720102077911563944056",
"3880958521678648721386666271288173453",
"156330159579510008341470887312470345453"
]
},
"target": {
"file": "xwiki-platform-core/xwiki-platform-flamingo/xwiki-platform-flamingo-skin/xwiki-platform-flamingo-skin-test/xwiki-platform-flamingo-skin-test-docker/src/test/it/org/xwiki/flamingo/test/docker/VersionIT.java"
},
"id": "CVE-2023-36468-d979ab3b"
},
{
"signature_version": "v1",
"deprecated": false,
"source": "https://github.com/xwiki/xwiki-platform/commit/15a6f845d8206b0ae97f37aa092ca43d4f9d6e59",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"276942104518944115248350598529824277360",
"246697261902894235528493432365070088166",
"222535766503053559958425459378814265244"
]
},
"target": {
"file": "xwiki-platform-core/xwiki-platform-test/xwiki-platform-test-ui/src/main/java/org/xwiki/test/ui/po/HistoryPane.java"
},
"id": "CVE-2023-36468-da970f01"
},
{
"signature_version": "v1",
"deprecated": false,
"source": "https://github.com/xwiki/xwiki-platform/commit/15a6f845d8206b0ae97f37aa092ca43d4f9d6e59",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"174386889392609305537377293675838908499",
"280822806730664088377572570275316574337",
"340012430739355321488876622105859697599"
]
},
"target": {
"file": "xwiki-platform-core/xwiki-platform-display/xwiki-platform-display-api/src/main/java/org/xwiki/display/internal/DocumentContentAsyncRenderer.java"
},
"id": "CVE-2023-36468-de18821e"
},
{
"signature_version": "v1",
"deprecated": false,
"source": "https://github.com/xwiki/xwiki-platform/commit/15a6f845d8206b0ae97f37aa092ca43d4f9d6e59",
"signature_type": "Function",
"digest": {
"function_hash": "204288151456559076674249951942442973929",
"length": 1697.0
},
"target": {
"file": "xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/doc/XWikiDocument.java",
"function": "cloneInternal"
},
"id": "CVE-2023-36468-de3a330a"
},
{
"signature_version": "v1",
"deprecated": false,
"source": "https://github.com/xwiki/xwiki-platform/commit/15a6f845d8206b0ae97f37aa092ca43d4f9d6e59",
"signature_type": "Function",
"digest": {
"function_hash": "287064920237796484083759288912817377376",
"length": 1978.0
},
"target": {
"file": "xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/doc/XWikiDocumentRenderingTest.java",
"function": "setup"
},
"id": "CVE-2023-36468-df6cf95a"
},
{
"signature_version": "v1",
"deprecated": false,
"source": "https://github.com/xwiki/xwiki-platform/commit/15a6f845d8206b0ae97f37aa092ca43d4f9d6e59",
"signature_type": "Function",
"digest": {
"function_hash": "144885478412044114390634570464544250161",
"length": 467.0
},
"target": {
"file": "xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/doc/XWikiDocumentMockitoTest.java",
"function": "tofromXMLDocument"
},
"id": "CVE-2023-36468-f401224b"
},
{
"signature_version": "v1",
"deprecated": false,
"source": "https://github.com/xwiki/xwiki-platform/commit/15a6f845d8206b0ae97f37aa092ca43d4f9d6e59",
"signature_type": "Function",
"digest": {
"function_hash": "296723282724734520624419204872831042481",
"length": 25173.0
},
"target": {
"file": "xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/test/MockitoOldcore.java",
"function": "before"
},
"id": "CVE-2023-36468-f7603601"
},
{
"signature_version": "v1",
"deprecated": false,
"source": "https://github.com/xwiki/xwiki-platform/commit/15a6f845d8206b0ae97f37aa092ca43d4f9d6e59",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"306680397624765021903643040936913233907",
"274914008552794379919472362541629966448",
"265910708343939236076979540637361896795",
"31486284957954308370321548377879702120",
"310193289869039981419096259869396047378",
"225084596401143472466102322833890856338",
"259924122661507480505521871111862196322",
"6575990602949897535108324136252536156",
"148064001832138838127088634736306180839",
"132620890079883448053891578938940842909",
"4632975897174658262373675725238105283",
"55123911454506762122206379659335490021",
"279380096971811795801937773712990639007",
"279306183752140341330701886149529092239",
"328757593578206484476094265018843544095",
"2591774583556728543831994741815357475",
"307714854135084051502434795070832162266",
"284110241762430253124286134208724149043",
"36636375595781466539634711734922845412",
"70402363866947698563329524054784525057"
]
},
"target": {
"file": "xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/doc/XWikiDocument.java"
},
"id": "CVE-2023-36468-f84e9dc4"
}
]