Security Digest · page 4 of 4
Critical Maven advisories (page 4)
334 critical advisories for Maven packages since October 2023, newest first. Check your project with mvn dependency:tree -Dincludes=<groupId>:<artifactId>.
- Jupiter allows attackers to execute arbitrary commands via sending a crafted RPC request CVE-2023-48887 CVSS 9.8 Critical
org.jupiter-rpc:jupiter-rpc<= 1.3.1 → no fix listed - Apache Cocoon SQL Injection vulnerability CVE-2022-45135 CVSS 9.8 Critical
org.apache.cocoon:cocoon>= 2.2.0, < 2.3.0 → fixed in 2.3.0 - Apache Cocoon Improper Restriction of XML External Entity Reference vulnerability CVE-2023-49733 CVSS 9.8 Critical
org.apache.cocoon:cocoon>= 2.2.0, < 2.3.0 → fixed in 2.3.0 - Apache Derby: LDAP injection vulnerability in authenticator CVE-2022-46337 CVSS 9.8 Critical
org.apache.derby:derby>= 10.1.1.0, <= 10.1.3.1 → no fix listed;org.apache.derby:derby>= 10.2.1.6, <= 10.2.2.0 → no fix listed;org.apache.derby:derby>= 10.3.1.4, <= 10.3.3.0 → no fix listed; +13 more packages - Run Shell Command allows Cross-Site Request Forgery CVE-2023-48292 CVSS 9.6 Critical
org.xwiki.contrib:xwiki-application-admintools>= 4.4, < 4.5.1 → fixed in 4.5.1 - Cookies are sent to external images in rendered diff (and server side request forgery) CVE-2023-48240 CVSS 9.0 Critical
org.xwiki.platform:xwiki-platform-diff-xml>= 11.10.1, < 14.10.15 → fixed in 14.10.15;org.xwiki.platform:xwiki-platform-diff-xml>= 15.0-rc-1, < 15.5.1 → fixed in 15.5.1;org.xwiki.platform:xwiki-platform-diff-xml>= 15.6-rc-1, < 15.6 → fixed in 15.6 - Liferay Portal XSS with `p_l_back_url_title` on edit content page CVE-2023-47797 CVSS 9.6 Critical
com.liferay.portal:release.portal.bom>= 7.4.3.94, < 7.4.3.96 → fixed in 7.4.3.96 - H2O local file inclusion vulnerability CVE-2023-6038 CVSS 9.3 Critical
ai.h2o:h2o-core<= 3.40.0.4 → no fix listed - XWiki Platform vulnerable to reflected cross-site scripting through revision parameter in content menu CVE-2023-46732 CVSS 9.6 Critical
org.xwiki.platform:xwiki-platform-flamingo-skin-resources>= 9.7-rc-1, < 14.10.14 → fixed in 14.10.14;org.xwiki.platform:xwiki-platform-flamingo-skin-resources>= 15.0-rc-1, < 15.5.1 → fixed in 15.5.1 - XWiki Platform vulnerable to remote code execution through the section parameter in Administration as guest CVE-2023-46731 CVSS 10.0 Critical
org.xwiki.platform:xwiki-platform-administration-ui< 14.10.14 → fixed in 14.10.14;org.xwiki.platform:xwiki-platform-administration-ui>= 15.0-rc-1, < 15.5.1 → fixed in 15.5.1;org.xwiki.platform:xwiki-platform-administration< 14.10.14 → fixed in 14.10.14 - XWiki Platform privilege escalation from script right to programming right through title displayer CVE-2023-46244 CVSS 9.1 Critical
org.xwiki.platform:xwiki-platform-display-api>= 3.2-milestone-3, < 14.10.7 → fixed in 14.10.7;org.xwiki.platform:xwiki-platform-display-api>= 15.0, < 15.2-rc-1 → fixed in 15.2-rc-1 - XWiki Platform vulnerable to remote code execution via the edit action because it lacks CSRF token CVE-2023-46242 CVSS 9.6 Critical
org.xwiki.platform:xwiki-platform-oldcore>= 1.0, < 14.10.7 → fixed in 14.10.7;org.xwiki.platform:xwiki-platform-oldcore>= 15.0, < 15.2-rc-1 → fixed in 15.2-rc-1 - OpenCRX allows a remote attacker to execute arbitrary code via a crafted request CVE-2023-46502 CVSS 9.8 Critical
org.opencrx:opencrx-client< 5.3.0 → fixed in 5.3.0 - Apache ActiveMQ is vulnerable to Remote Code Execution CVE-2023-46604 CVSS 10.0 Critical
org.apache.activemq:activemq-client< 5.15.16 → fixed in 5.15.16;org.apache.activemq:activemq-client>= 5.16.0, < 5.16.7 → fixed in 5.16.7;org.apache.activemq:activemq-client>= 5.17.0, < 5.17.6 → fixed in 5.17.6; +5 more packages - org.xwiki.platform:xwiki-platform-office-importer vulnerable to arbitrary server side file writing from account through office converter CVE-2023-37913 CVSS 9.9 Critical
org.xwiki.platform:xwiki-platform-office-importer>= 3.5-milestone-1, < 14.10.8 → fixed in 14.10.8;org.xwiki.platform:xwiki-platform-office-importer>= 15.0-rc-1, < 15.3-rc-1 → fixed in 15.3-rc-1 - XWiki Platform web templates vulnerable to reflected XSS in the create document form if name validation is enabled CVE-2023-45136 CVSS 9.6 Critical
org.xwiki.platform:xwiki-platform-web-templates>= 12.0-rc-1, < 14.10.12 → fixed in 14.10.12;org.xwiki.platform:xwiki-platform-web-templates>= 15.0-rc-1, < 15.5-rc-1 → fixed in 15.5-rc-1 - XWiki Platform XSS vulnerability from account in the create page form via template provider CVE-2023-45134 CVSS 9.0 Critical
org.xwiki.platform:xwiki-platform-web-templates< 14.10.12 → fixed in 14.10.12;org.xwiki.platform:xwiki-platform-web-templates>= 15.0-rc-1, < 15.5-rc-1 → fixed in 15.5-rc-1;org.xwiki.platform:xwiki-web-standard>= 2.4-milestone-2, < 3.1-milestone-1 → fixed in 3.1-milestone-1; +1 more packages - XWiki users can be tricked to execute scripts as the create page action doesn't display the page's title CVE-2023-45135 CVSS 9.0 Critical
org.xwiki.platform:xwiki-platform-web-templates< 14.10.12 → fixed in 14.10.12;org.xwiki.platform:xwiki-platform-web-templates>= 15.0-rc-1, < 15.5-rc-1 → fixed in 15.5-rc-1;org.xwiki.platform:xwiki-platform-web>= 7.2-milestone-2, < 14.10.12 → fixed in 14.10.12 - XWiki Platform vulnerable to XSS with edit right in the create document form for existing pages CVE-2023-45137 CVSS 9.0 Critical
org.xwiki.platform:xwiki-platform-web-templates< 14.10.12 → fixed in 14.10.12;org.xwiki.platform:xwiki-platform-web-templates>= 15.0-rc-1, < 15.5-rc-1 → fixed in 15.5-rc-1;org.xwiki.platform:xwiki-platform-web>= 3.1-milestone-2, < 13.4-rc-1 → fixed in 13.4-rc-1 - org.xwiki.rendering:xwiki-rendering-xml Improper Neutralization of Invalid Characters in Identifiers in Web Pages vulnerability CVE-2023-37908 CVSS 9.6 Critical
org.xwiki.rendering:xwiki-rendering-xml>= 14.6-rc-1, < 14.10.4 → fixed in 14.10.4 - SaToken privilege escalation vulnerability CVE-2023-44794 CVSS 9.3 Critical
cn.dev33:sa-token-core< 1.37.0 → fixed in 1.37.0 - Sureness uses hardcoded key CVE-2023-31581 CVSS 9.8 Critical
com.usthe.sureness:sureness-core< 1.0.8 → fixed in 1.0.8 - Yamcs API Directory Traversal vulnerability CVE-2023-45278 CVSS 9.1 Critical
org.yamcs:yamcs< 5.8.7 → fixed in 5.8.7 - Liferay Portal and Liferay DXP Vulnerable to Reflected XSS via the Export for Translation Page CVE-2023-42497 CVSS 9.6 Critical
com.liferay:com.liferay.translation.web< 2.0.86 → fixed in 2.0.86;com.liferay.portal:release.dxp.bom>= 7.4.0, < 7.4.13.u86 → fixed in 7.4.13.u86 - Liferay Portal and Liferay DXP Vulnerable to XSS in the Commerce Module CVE-2023-42627 CVSS 9.6 Critical
com.liferay.commerce:com.liferay.commerce.address.content.web< 4.0.35 → fixed in 4.0.35;com.liferay.portal:release.dxp.bom>= 7.3.0, <= 7.3.10.u33 → no fix listed;com.liferay.portal:release.dxp.bom>= 7.4.0, <= 7.4.13.u92 → no fix listed - Liferay Portal and Liferay DXP Vulnerable to XSS in the Fragment Components CVE-2023-44309 CVSS 9.0 Critical
com.liferay:com.liferay.fragment.entry.processor.impl< 3.0.25 → fixed in 3.0.25;com.liferay.portal:release.dxp.bom>= 7.4.0, < 7.4.13.u54 → fixed in 7.4.13.u54 - Liferay Portal and Liferay DXP Vulnerable to XSS via the Page Tree Menu CVE-2023-44310 CVSS 9.0 Critical
com.liferay:com.liferay.layout.impl< 6.0.102 → fixed in 6.0.102;com.liferay.portal:release.dxp.bom>= 7.3.10.fp1, <= 7.3.10.fp23 → no fix listed;com.liferay.portal:release.dxp.bom>= 7.4.0, < 7.4.13.u79 → fixed in 7.4.13.u79 - Liferay Portal and Liferay DXP Vulnerable to XSS in the Wiki Widget CVE-2023-42628 CVSS 9.0 Critical
com.liferay:com.liferay.wiki.web< 7.0.95 → fixed in 7.0.95;com.liferay.portal:release.dxp.bom>= 7.0.10.fp83, <= 7.0.10.fp102 → no fix listed;com.liferay.portal:release.dxp.bom>= 7.1.0, <= 7.1.10.fp28 → no fix listed; +3 more packages - XWiki Identity Oauth Privilege escalation (PR)/remote code execution from login screen through unescaped URL parameter CVE-2023-45144 CVSS 10.0 Critical
com.xwiki.identity-oauth:identity-oauth-ui>= 1.0, < 1.6 → fixed in 1.6 - Liferay Portal and Liferay DXP Vulnerable to Stored XSS in the Manage Vocabulary Page CVE-2023-42629 CVSS 9.0 Critical
com.liferay:com.liferay.asset.categories.admin.web< 5.0.87 → fixed in 5.0.87;com.liferay.portal:release.dxp.bom>= 7.4.0, < 7.4.13.u88 → fixed in 7.4.13.u88 - Liferay Portal and Liferay DXP Vulnerable to XSS via the OAuth2ProviderApplicationRedirect Class CVE-2023-44311 CVSS 9.6 Critical
com.liferay:com.liferay.oauth2.provider.rest< 4.0.51 → fixed in 4.0.51;com.liferay.portal:release.dxp.bom>= 7.4.13.u41, < 7.4.13.u90 → fixed in 7.4.13.u90 - Authorization Bypass in Apache InLong CVE-2023-43668 CVSS 9.8 Critical
org.apache.inlong:manager-pojo>= 1.4.0, < 1.9.0 → fixed in 1.9.0 - XWiki Change Request Application UI XSS and remote code execution through change request title CVE-2023-45138 CVSS 10.0 Critical
org.xwiki.contrib.changerequest:application-changerequest-ui>= 0.11, < 1.9.2 → fixed in 1.9.2 - Authorization Bypass Through User-Controlled Key vulnerability in Apache ZooKeeper CVE-2023-44981 CVSS 9.1 Critical
org.apache.zookeeper:zookeeper< 3.7.2 → fixed in 3.7.2;org.apache.zookeeper:zookeeper>= 3.8.0, < 3.8.3 → fixed in 3.8.3;org.apache.zookeeper:zookeeper>= 3.9.0, < 3.9.1 → fixed in 3.9.1