A vulnerability was detected in Foswiki up to 2.1.10. The affected element is an unknown function of the component Changes/Viewfile/Oops. The manipulation results in information disclosure. It is possible to launch the attack remotely. The exploit is now public and may be used. Upgrading to version 2.1.11 is sufficient to fix this issue. The patch is identified as 31aeecb58b64/d8ed86b10e46. Upgrading the affected component is recommended.
An issue in the SpreadSheetPlugin component of Foswiki v2.1.7 and below allows attackers to execute a directory traversal.
Insufficient parameter validation in the Foswiki::Sandbox component of Foswiki v2.1.7 and below allows attackers to perform a directory traversal via supplying a crafted web request.
Dear all,
we've got a new release out. Update is highly recommended as it fixes 9 critical security related bugs, i.e.
CVE-2023-33756: SpreadSheetPlugin's EVAL feature exposes information about paths and files on the server CVE-2023-24698: Local file inclusion vulnerability in viewfile
Read more about it at https://blog.foswiki.org/Blog/Foswiki218IsReleased
Regards, Michael.
-- -- Michael Daum Consulting -- Knowledge Management Service & Solutions -- https://www.michaeldaumconsulting.com -- Tel: +49 (0)40 21 99 27 51
Foswiki before 1.1.8 contains a code injection vulnerability in the MAKETEXT macro.
The localization functionality in TWiki before 5.1.3, and Foswiki 1.0.x through 1.0.10 and 1.1.x through 1.1.6, allows remote attackers to cause a denial of service (memory consumption) via a large integer in a %MAKETEXT% macro.