---
title: "Critical Maven advisories (page 4)"
url: https://erroneo.us/security/ecosystem/maven/4/
description: "All 334 critical GitHub-reviewed Maven security advisories since October 2023, newest first, with vulnerable ranges and fixed versions. Page 4 of 4."
type: ecosystem
section: "Security Digest"
date_modified: 2023-12-01
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Critical Maven advisories (page 4)

- 2023-12-01 [CVE-2023-48887](https://erroneo.us/security/cve/CVE-2023-48887/index.md) Jupiter allows attackers to execute arbitrary commands via sending a crafted RPC request — org.jupiter-rpc:jupiter-rpc <= 1.3.1 → no fix
- 2023-11-30 [CVE-2022-45135](https://erroneo.us/security/cve/CVE-2022-45135/index.md) Apache Cocoon SQL Injection vulnerability — org.apache.cocoon:cocoon >= 2.2.0, < 2.3.0 → 2.3.0
- 2023-11-30 [CVE-2023-49733](https://erroneo.us/security/cve/CVE-2023-49733/index.md) Apache Cocoon Improper Restriction of XML External Entity Reference vulnerability — org.apache.cocoon:cocoon >= 2.2.0, < 2.3.0 → 2.3.0
- 2023-11-20 [CVE-2022-46337](https://erroneo.us/security/cve/CVE-2022-46337/index.md) Apache Derby: LDAP injection vulnerability in authenticator — org.apache.derby:derby >= 10.1.1.0, <= 10.1.3.1 → no fix; org.apache.derby:derby >= 10.2.1.6, <= 10.2.2.0 → no fix; org.apache.derby:derby >= 10.3.1.4, <= 10.3.3.0 → no fix
- 2023-11-20 [CVE-2023-48292](https://erroneo.us/security/cve/CVE-2023-48292/index.md) Run Shell Command allows Cross-Site Request Forgery — org.xwiki.contrib:xwiki-application-admintools >= 4.4, < 4.5.1 → 4.5.1
- 2023-11-20 [CVE-2023-48240](https://erroneo.us/security/cve/CVE-2023-48240/index.md) Cookies are sent to external images in rendered diff (and server side request forgery) — org.xwiki.platform:xwiki-platform-diff-xml >= 11.10.1, < 14.10.15 → 14.10.15; org.xwiki.platform:xwiki-platform-diff-xml >= 15.0-rc-1, < 15.5.1 → 15.5.1; org.xwiki.platform:xwiki-platform-diff-xml >= 15.6-rc-1, < 15.6 → 15.6
- 2023-11-16 [CVE-2023-47797](https://erroneo.us/security/cve/CVE-2023-47797/index.md) Liferay Portal XSS with `p_l_back_url_title` on edit content page — com.liferay.portal:release.portal.bom >= 7.4.3.94, < 7.4.3.96 → 7.4.3.96
- 2023-11-16 [CVE-2023-6038](https://erroneo.us/security/cve/CVE-2023-6038/index.md) H2O local file inclusion vulnerability — ai.h2o:h2o-core <= 3.40.0.4 → no fix
- 2023-11-08 [CVE-2023-46732](https://erroneo.us/security/cve/CVE-2023-46732/index.md) XWiki Platform vulnerable to  reflected cross-site scripting through revision parameter in content menu — org.xwiki.platform:xwiki-platform-flamingo-skin-resources >= 9.7-rc-1, < 14.10.14 → 14.10.14; org.xwiki.platform:xwiki-platform-flamingo-skin-resources >= 15.0-rc-1, < 15.5.1 → 15.5.1
- 2023-11-08 [CVE-2023-46731](https://erroneo.us/security/cve/CVE-2023-46731/index.md) XWiki Platform vulnerable to remote code execution through the section parameter in Administration as guest — org.xwiki.platform:xwiki-platform-administration-ui < 14.10.14 → 14.10.14; org.xwiki.platform:xwiki-platform-administration-ui >= 15.0-rc-1, < 15.5.1 → 15.5.1; org.xwiki.platform:xwiki-platform-administration < 14.10.14 → 14.10.14
- 2023-11-07 [CVE-2023-46244](https://erroneo.us/security/cve/CVE-2023-46244/index.md) XWiki Platform privilege escalation from script right to programming right through title displayer — org.xwiki.platform:xwiki-platform-display-api >= 3.2-milestone-3, < 14.10.7 → 14.10.7; org.xwiki.platform:xwiki-platform-display-api >= 15.0, < 15.2-rc-1 → 15.2-rc-1
- 2023-11-07 [CVE-2023-46242](https://erroneo.us/security/cve/CVE-2023-46242/index.md) XWiki Platform vulnerable to remote code execution via the edit action because it lacks CSRF token — org.xwiki.platform:xwiki-platform-oldcore >= 1.0, < 14.10.7 → 14.10.7; org.xwiki.platform:xwiki-platform-oldcore >= 15.0, < 15.2-rc-1 → 15.2-rc-1
- 2023-10-30 [CVE-2023-46502](https://erroneo.us/security/cve/CVE-2023-46502/index.md) OpenCRX allows a remote attacker to execute arbitrary code via a crafted request — org.opencrx:opencrx-client < 5.3.0 → 5.3.0
- 2023-10-27 [CVE-2023-46604](https://erroneo.us/security/cve/CVE-2023-46604/index.md) Apache ActiveMQ is vulnerable to Remote Code Execution — org.apache.activemq:activemq-client < 5.15.16 → 5.15.16; org.apache.activemq:activemq-client >= 5.16.0, < 5.16.7 → 5.16.7; org.apache.activemq:activemq-client >= 5.17.0, < 5.17.6 → 5.17.6
- 2023-10-25 [CVE-2023-37913](https://erroneo.us/security/cve/CVE-2023-37913/index.md) org.xwiki.platform:xwiki-platform-office-importer vulnerable to arbitrary server side file writing from account through office converter — org.xwiki.platform:xwiki-platform-office-importer >= 3.5-milestone-1, < 14.10.8 → 14.10.8; org.xwiki.platform:xwiki-platform-office-importer >= 15.0-rc-1, < 15.3-rc-1 → 15.3-rc-1
- 2023-10-25 [CVE-2023-45136](https://erroneo.us/security/cve/CVE-2023-45136/index.md) XWiki Platform web templates vulnerable to reflected XSS in the create document form if name validation is enabled — org.xwiki.platform:xwiki-platform-web-templates >= 12.0-rc-1, < 14.10.12 → 14.10.12; org.xwiki.platform:xwiki-platform-web-templates >= 15.0-rc-1, < 15.5-rc-1 → 15.5-rc-1
- 2023-10-25 [CVE-2023-45134](https://erroneo.us/security/cve/CVE-2023-45134/index.md) XWiki Platform XSS vulnerability from account in the create page form via template provider — org.xwiki.platform:xwiki-platform-web-templates < 14.10.12 → 14.10.12; org.xwiki.platform:xwiki-platform-web-templates >= 15.0-rc-1, < 15.5-rc-1 → 15.5-rc-1; org.xwiki.platform:xwiki-web-standard >= 2.4-milestone-2, < 3.1-milestone-1 → 3.1-milestone-1
- 2023-10-25 [CVE-2023-45135](https://erroneo.us/security/cve/CVE-2023-45135/index.md) XWiki users can be tricked to execute scripts as the create page action doesn't display the page's title — org.xwiki.platform:xwiki-platform-web-templates < 14.10.12 → 14.10.12; org.xwiki.platform:xwiki-platform-web-templates >= 15.0-rc-1, < 15.5-rc-1 → 15.5-rc-1; org.xwiki.platform:xwiki-platform-web >= 7.2-milestone-2, < 14.10.12 → 14.10.12
- 2023-10-25 [CVE-2023-45137](https://erroneo.us/security/cve/CVE-2023-45137/index.md) XWiki Platform vulnerable to XSS with edit right in the create document form for existing pages — org.xwiki.platform:xwiki-platform-web-templates < 14.10.12 → 14.10.12; org.xwiki.platform:xwiki-platform-web-templates >= 15.0-rc-1, < 15.5-rc-1 → 15.5-rc-1; org.xwiki.platform:xwiki-platform-web >= 3.1-milestone-2, < 13.4-rc-1 → 13.4-rc-1
- 2023-10-25 [CVE-2023-37908](https://erroneo.us/security/cve/CVE-2023-37908/index.md) org.xwiki.rendering:xwiki-rendering-xml Improper Neutralization of Invalid Characters in Identifiers in Web Pages vulnerability — org.xwiki.rendering:xwiki-rendering-xml >= 14.6-rc-1, < 14.10.4 → 14.10.4
- 2023-10-25 [CVE-2023-44794](https://erroneo.us/security/cve/CVE-2023-44794/index.md) SaToken privilege escalation vulnerability — cn.dev33:sa-token-core < 1.37.0 → 1.37.0
- 2023-10-25 [CVE-2023-31581](https://erroneo.us/security/cve/CVE-2023-31581/index.md) Sureness uses hardcoded key — com.usthe.sureness:sureness-core < 1.0.8 → 1.0.8
- 2023-10-19 [CVE-2023-45278](https://erroneo.us/security/cve/CVE-2023-45278/index.md) Yamcs API Directory Traversal vulnerability — org.yamcs:yamcs < 5.8.7 → 5.8.7
- 2023-10-17 [CVE-2023-42497](https://erroneo.us/security/cve/CVE-2023-42497/index.md) Liferay Portal and Liferay DXP Vulnerable to Reflected XSS via the Export for Translation Page — com.liferay:com.liferay.translation.web < 2.0.86 → 2.0.86; com.liferay.portal:release.dxp.bom >= 7.4.0, < 7.4.13.u86 → 7.4.13.u86
- 2023-10-17 [CVE-2023-42627](https://erroneo.us/security/cve/CVE-2023-42627/index.md) Liferay Portal and Liferay DXP Vulnerable to XSS in the Commerce Module — com.liferay.commerce:com.liferay.commerce.address.content.web < 4.0.35 → 4.0.35; com.liferay.portal:release.dxp.bom >= 7.3.0, <= 7.3.10.u33 → no fix; com.liferay.portal:release.dxp.bom >= 7.4.0, <= 7.4.13.u92 → no fix
- 2023-10-17 [CVE-2023-44309](https://erroneo.us/security/cve/CVE-2023-44309/index.md) Liferay Portal and Liferay DXP Vulnerable to XSS in the Fragment Components — com.liferay:com.liferay.fragment.entry.processor.impl < 3.0.25 → 3.0.25; com.liferay.portal:release.dxp.bom >= 7.4.0, < 7.4.13.u54 → 7.4.13.u54
- 2023-10-17 [CVE-2023-44310](https://erroneo.us/security/cve/CVE-2023-44310/index.md) Liferay Portal and Liferay DXP Vulnerable to XSS via the Page Tree Menu — com.liferay:com.liferay.layout.impl < 6.0.102 → 6.0.102; com.liferay.portal:release.dxp.bom >= 7.3.10.fp1, <= 7.3.10.fp23 → no fix; com.liferay.portal:release.dxp.bom >= 7.4.0, < 7.4.13.u79 → 7.4.13.u79
- 2023-10-17 [CVE-2023-42628](https://erroneo.us/security/cve/CVE-2023-42628/index.md) Liferay Portal and Liferay DXP Vulnerable to XSS in the Wiki Widget — com.liferay:com.liferay.wiki.web < 7.0.95 → 7.0.95; com.liferay.portal:release.dxp.bom >= 7.0.10.fp83, <= 7.0.10.fp102 → no fix; com.liferay.portal:release.dxp.bom >= 7.1.0, <= 7.1.10.fp28 → no fix
- 2023-10-17 [CVE-2023-45144](https://erroneo.us/security/cve/CVE-2023-45144/index.md) XWiki Identity Oauth Privilege escalation (PR)/remote code execution from login screen through unescaped URL parameter — com.xwiki.identity-oauth:identity-oauth-ui >= 1.0, < 1.6 → 1.6
- 2023-10-17 [CVE-2023-42629](https://erroneo.us/security/cve/CVE-2023-42629/index.md) Liferay Portal and Liferay DXP Vulnerable to Stored XSS in the Manage Vocabulary Page — com.liferay:com.liferay.asset.categories.admin.web < 5.0.87 → 5.0.87; com.liferay.portal:release.dxp.bom >= 7.4.0, < 7.4.13.u88 → 7.4.13.u88
- 2023-10-17 [CVE-2023-44311](https://erroneo.us/security/cve/CVE-2023-44311/index.md) Liferay Portal and Liferay DXP Vulnerable to XSS via the OAuth2ProviderApplicationRedirect Class — com.liferay:com.liferay.oauth2.provider.rest < 4.0.51 → 4.0.51; com.liferay.portal:release.dxp.bom >= 7.4.13.u41, < 7.4.13.u90 → 7.4.13.u90
- 2023-10-16 [CVE-2023-43668](https://erroneo.us/security/cve/CVE-2023-43668/index.md) Authorization Bypass in Apache InLong — org.apache.inlong:manager-pojo >= 1.4.0, < 1.9.0 → 1.9.0
- 2023-10-16 [CVE-2023-45138](https://erroneo.us/security/cve/CVE-2023-45138/index.md) XWiki Change Request Application UI XSS and remote code execution through change request title — org.xwiki.contrib.changerequest:application-changerequest-ui >= 0.11, < 1.9.2 → 1.9.2
- 2023-10-11 [CVE-2023-44981](https://erroneo.us/security/cve/CVE-2023-44981/index.md) Authorization Bypass Through User-Controlled Key vulnerability in Apache ZooKeeper — org.apache.zookeeper:zookeeper < 3.7.2 → 3.7.2; org.apache.zookeeper:zookeeper >= 3.8.0, < 3.8.3 → 3.8.3; org.apache.zookeeper:zookeeper >= 3.9.0, < 3.9.1 → 3.9.1

Pages: https://erroneo.us/security/ecosystem/maven/index.md · https://erroneo.us/security/ecosystem/maven/2/index.md · https://erroneo.us/security/ecosystem/maven/3/index.md · https://erroneo.us/security/ecosystem/maven/4/index.md

---
Source page: https://erroneo.us/security/ecosystem/maven/4/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt