Security
Headlines
HeadlinesLatestCVEs

Tag

#maven

GHSA-933g-v89r-x8pf: Apache Dubbo vulnerable to Deserialization of Untrusted Data

A deserialization vulnerability existed when dubbo generic invoke, which could lead to malicious code execution. This issue affects Apache Dubbo 2.7.x version 2.7.21 and prior versions; Apache Dubbo 3.0.x version 3.0.13 and prior versions; Apache Dubbo 3.1.x version 3.1.5 and prior versions.

ghsa
#vulnerability#apache#git#java#maven
GHSA-wmx7-x4jp-9jgg: OpenSearch has issue with fine-grained access control of indices backing data streams

### Impact There is an issue with the implementation of fine-grained access control rules (document-level security, field-level security and field masking) where they are not correctly applied to the indices that back data streams potentially leading to incorrect access authorization. This issue can only be triggered by authenticated users authorized to read those data streams which are backed by the impacted indexes. Additionally, existing privileged users cannot access random indexes within these clusters; they can only access indexes to which they have already been granted permission. ### Patches OpenSearch 1.3.7 and 2.4.0 contain a fix for this issue. ### Workarounds There is no recommended work around. ### For more information If you have any questions or comments about this advisory, please contact AWS/Amazon Security via our issue reporting page (https://aws.amazon.com/security/vulnerability-reporting/) or directly via email to aws-security@amazon.com. Please do not create a ...

GHSA-c6wg-cm5x-rqvj: OpenSearch has time discrepancy in authentication responses

### Impact There is an observable discrepancy in the authentication response time between calls where the user provided exists and calls where it does not. This issue only affects calls using the internal basic identity provider (IdP), and not other externally configured IdPs. ### Patches OpenSearch 1.3.9 and 2.6.0 ### Workarounds None. ### References If you have any questions or comments about this advisory, please contact AWS/Amazon Security using our issue reporting page [1] or directly via email [2]. Please do not create a public GitHub issue. [1] AWS Security issue reporting page: https://aws.amazon.com/security/vulnerability-reporting/ [2] AWS Security email: [aws-security@amazon.com](mailto:aws-security@amazon.com)

GHSA-859x-p6jp-rc2w: xwiki contains Incorrect Authorization

### Impact It's possible to execute a script with the right of another user (provided the target user does not have programming right). For example, the following: ``` {{context document="xwiki:XWiki.userwithscriptright" transformationContext="document"}}{{velocity}}Hello from Velocity!{{/velocity}}{{/context}} ``` written by a user not having script right (for example in the user's profile) should produce an error (the user is not allowed to write scripts). However, because of the vulnerability, if the author of the document "xwiki:XWiki.userwithscriptright" has script right (but not programming right) the script will be executed with as if it was written by the target user. ### Patches The problem has been patched in XWiki 14.8RC1, 14.4.5 and 13.10.10. ### Workarounds There's no workaround for this issue. ### References https://jira.xwiki.org/browse/XWIKI-19856 ### For more information If you have any questions or comments about this advisory: * Open an issue in [JIRA](htt...

GHSA-32fq-m2q5-h83g: XWiki-Platform vulnerable to stored Cross-site Scripting via the HTML displayer in Live Data

### Impact A user without script rights can introduce a stored XSS by using the Live Data macro. For instance: ``` {{liveData id="movies" properties="title,description"}} { "data": { "count": 1, "entries": [ { "title": "Meet John Doe", "url": "https://www.imdb.com/title/tt0033891/", "description": "<img onerror='alert(1)' src='foo' />" } ] }, "meta": { "propertyDescriptors": [ { "id": "title", "name": "Title", "visible": true, "displayer": {"id": "link", "propertyHref": "url"} }, { "id": "description", "name": "Description", "visible": true, "displayer": "html" } ] } } {{/liveData}} ``` ### Patches This has been patched in XWiki 14.9, 14.4.7, and 13.10.10. ### Workarounds No known workaround. ### References https://jira.xwiki.org/browse/XWIKI-20143 ### For more information If you have any questions or comments about this advisory:...

GHSA-52vf-hvv3-98h7: xwiki vulnerable to Improper Handling of Exceptional Conditions

### Impact Users with write rights can insert well-formed content that is not handled well by the parser. For instance, with `xwiki/2.1`, inserting a deeply nested group blocks (`((( ((( ((( ((( .... ))) ))) ))) )))` (see the generator below to produce a large payload) can lead to the parser throwing a `StackOverflowError`. As a consequence, some pages becomes unusable, including: - the user index (if the page containing the faulty content is a user page) - the page index Note that on the page, the normal UI is completely missing and it is not possible to open the editor directly to revert the change as the stack overflow is already triggered while getting the title of the document. This means that it is quite difficult to remove this content once inserted. ### Patches This has been patched on XWiki 13.10.10, 14.4.6, and 14.9-rc-1. ### Workarounds A temporary solution to avoid Stack Overflow errors is to increase the memory allocated to the stack by using the `-Xss` JVM parameter (e...

GHSA-8692-g6g9-gm5p: xwiki contains Exposed Dangerous Method or Function

### Impact `org.xwiki.store.script.TemporaryAttachmentsScriptService#uploadTemporaryAttachment` is returning an instance of `com.xpn.xwiki.doc.XWikiAttachment`. This class is not supported to be exposed to users without the `programing` right. `com.xpn.xwiki.api.Attachment` should be used instead and takes case of checking the user's rights before performing dangerous operations. ### Patches This has been patched in the version 14.9-rc-1 and 14.4.6. ### Workarounds There's no workaround for this issue. ### References https://jira.xwiki.org/browse/XWIKI-20180 ### For more information If you have any questions or comments about this advisory: * Open an issue in [JIRA](https://jira.xwiki.org/) * Email us at [security ML](mailto:security@xwiki.org)

GHSA-x2qm-r4wx-8gpg: org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability

### Impact It's possible to inject arbitrary wiki syntax including Groovy, Python and Velocity script macros via the `newThemeName` request parameter (URL parameter), in combination with additional parameters `form_token=1&action=create`. For instance: [http://127.0.0.1:8080/xwiki/bin/view/FlamingoThemesCode/WebHomeSheet?newThemeName=foo%22%2F%7D%7D%7B%7Basync%20async%3D%22true%22%20cached%3D%22false%22%20context%3D%22doc.reference%22%7D%7D%7B%7Bgroovy%7D%7Dprintln(%22hello%20from%20groovy!%22)%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fasync%7D%7D&form_token=1&action=create](http://127.0.0.1:8080/xwiki/bin/view/FlamingoThemesCode/WebHomeSheet?**newThemeName**=foo%22%2F%7D%7D%7B%7Basync%20async%3D%22true%22%20cached%3D%22false%22%20context%3D%22doc.reference%22%7D%7D%7B%7Bgroovy%7D%7Dprintln(%22hello%20from%20groovy!%22)%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fasync%7D%7D&form_token=1&action=create) will execute the following groovy code: `println("hello from groovy!")` on the server. ### Patches This has be...

GHSA-9cqm-5wf7-wcj7: XWiki Platform users may execute anything with superadmin right through comments and async macro

### Impact Comments are supposed to be executed with the right of superadmin but in restricted mode (anything dangerous is disabled) but the async macro is not taking into account the restricted mode. This means that any user with comment right can use the async macro to make it execute any wiki content with the right of superadmin as in: {{async}} {{groovy}}println "it works !"{{/groovy}} {{/async}} ### Patches This has been patched in XWiki 14.9, 14.4.6, and 13.10.10. ### Workarounds The only known workaround consists in applying [the following patch](https://github.com/xwiki/xwiki-platform/commit/00532d9f1404287cf3ec3a05056640d809516006) and rebuilding and redeploying `org.xwiki.platform:xwiki-platform-rendering-async-macro`. ### References * https://jira.xwiki.org/browse/XWIKI-20234 ### For more information If you have any questions or comments about this advisory: * Open an issue in [Jira](http://jira.xwiki.org) * Email us at [Security ML](mailto:security@xwiki.org)

GHSA-8cw6-4r32-6r3h: XWiki Platform may allow privilege escalation to programming rights via user's first name

### Impact Any user can edit his own profile and inject code which is going to be executed with programming right. Steps to reproduce: * Set your first name to ``` {{cache id="userProfile"}}{{groovy}}println("Hello from groovy!"){{/groovy}}{{/cache}} ``` The first name appears as interpreted "`Hello from groovy`" instead of the expected fully escaped "`{{cache id="userProfile"}}{{groovy}}println("Hello from groovy!"){{/groovy}}{{/cache}}`". The same vulnerability can also be exploited in all other places where short text properties are displayed, e.g., in apps created using [Apps Within Minutes](https://extensions.xwiki.org/xwiki/bin/view/Extension/App%20Within%20Minutes%20Application) that use a short text field. ### Patches The problem has been patched on versions 13.10.9, 14.4.4, 14.7RC1. ### Workarounds There are no other workarounds than upgrading XWiki or patching the xwiki-commons-xml JAR file. ### References * https://jira.xwiki.org/browse/XWIKI-19793 * https://jira...