xwiki/xwiki-platform · Security
XWiki Platform vulnerable to page render failure due to broken translations
- GHSA ID
- GHSA-9jq5-xwqw-q8j3
- CVE ID
- CVE-2023-29520
- Severity
- medium
- Published
- Updated
- CVSS
- 4.3 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- CVSS v3
- 4.3 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Description
Impact
It's possible to break many translations coming from wiki pages by creating a corrupted document containing a translation object.
Patches
The vulnerability has been patched in XWiki 15.0-rc-1, 14.10.1, 14.4.8, and 13.10.11.
Workarounds
There is no other workaround other than fixing any way to create a document that fail to load.
References
https://jira.xwiki.org/browse/XWIKI-20460
For more information
If you have any questions or comments about this advisory:
- Open an issue in Jira XWiki.org
- Email us at Security Mailing List
CWEs
- CWE-248 · Uncaught Exception
- CWE-755 · Improper Handling of Exceptional Conditions