GHSA-9jq5-xwqw-q8j3

Source

https://github.com/advisories/GHSA-9jq5-xwqw-q8j3

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/04/GHSA-9jq5-xwqw-q8j3/GHSA-9jq5-xwqw-q8j3.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-9jq5-xwqw-q8j3

Aliases

CVE-2023-29520

Published

2023-04-20T22:05:26Z

Modified

2023-11-01T05:01:50.631533Z

Severity

4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CVSS Calculator

Summary

XWiki Platform vulnerable to page render failure due to broken translations

Details

Impact

It's possible to break many translations coming from wiki pages by creating a corrupted document containing a translation object.

Patches

The vulnerability has been patched in XWiki 15.0-rc-1, 14.10.1, 14.4.8, and 13.10.11.

Workarounds

There is no other workaround other than fixing any way to create a document that fail to load.

References

https://jira.xwiki.org/browse/XWIKI-20460

For more information

If you have any questions or comments about this advisory: * Open an issue in Jira XWiki.org * Email us at Security Mailing List

Database specific

{
    "nvd_published_at": "2023-04-19T00:15:08Z",
    "cwe_ids": [
        "CWE-248",
        "CWE-755"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2023-04-20T22:05:26Z"
}

References

Affected packages

Maven / org.xwiki.platform:xwiki-platform-localization-source-wiki

Package

Name: org.xwiki.platform:xwiki-platform-localization-source-wiki; View open source insights on deps.dev
Purl: pkg:maven/org.xwiki.platform/xwiki-platform-localization-source-wiki

Affected ranges

Type: ECOSYSTEM
Events: Introduced

4.3-milestone-2

Fixed

13.10.11

Maven / org.xwiki.platform:xwiki-platform-localization-source-wiki

Package

Name: org.xwiki.platform:xwiki-platform-localization-source-wiki; View open source insights on deps.dev
Purl: pkg:maven/org.xwiki.platform/xwiki-platform-localization-source-wiki

Affected ranges

Type: ECOSYSTEM
Events: Introduced

14.0-rc-1

Fixed

14.4.8

Maven / org.xwiki.platform:xwiki-platform-localization-source-wiki

Package

Name: org.xwiki.platform:xwiki-platform-localization-source-wiki; View open source insights on deps.dev
Purl: pkg:maven/org.xwiki.platform/xwiki-platform-localization-source-wiki

Affected ranges

Type: ECOSYSTEM
Events: Introduced

14.5

Fixed

14.10.1