{"id":"CVE-2023-36470","summary":"Code injection in icon themes of XWiki Platform","details":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. By either creating a new or editing an existing document with an icon set, an attacker can inject XWiki syntax and Velocity code that is executed with programming rights and thus allows remote code execution. There are different attack vectors, the simplest is the Velocity code in the icon set's HTML or XWiki syntax definition. The [icon picker](https://extensions.xwiki.org/xwiki/bin/view/Extension/Icon%20Theme%20Application#HIconPicker) can be used to trigger the rendering of any icon set. The XWiki syntax variant of the icon set is also used without any escaping in some documents, allowing to inject XWiki syntax including script macros into a document that might have programming right, for this the currently used icon theme needs to be edited. Further, the HTML output of the icon set is output as JSON in the icon picker and this JSON is interpreted as XWiki syntax, allowing again the injection of script macros into a document with programming right and thus allowing remote code execution. This impacts the confidentiality, integrity and availability of the whole XWiki instance. This issue has been patched in XWiki 14.10.6 and 15.1. Icon themes now require script right and the code in the icon theme is executed within the context of the icon theme, preventing any rights escalation. A macro for displaying icons has been introduced to avoid injecting the raw wiki syntax of an icon set into another document. Users are advised to upgrade. There are no known workarounds for this vulnerability.\n","aliases":["GHSA-fm68-j7ww-h9xf"],"modified":"2026-08-12T14:51:06.830971Z","published":"2023-06-29T20:31:54.366Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-74"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/36xxx/CVE-2023-36470.json"},"references":[{"type":"WEB","url":"https://jira.xwiki.org/browse/XWIKI-20524"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/36xxx/CVE-2023-36470.json"},{"type":"ADVISORY","url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-fm68-j7ww-h9xf"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-36470"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/46b542854978e9caa687a5c2b8817b8b17877d94"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/79418dd92ca11941b46987ef881bf50424898ff4"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/b0cdfd893912baaa053d106a92e39fa1858843c7"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/xwiki/xwiki-commons","events":[{"introduced":"c7b2fe24e1384a01ffebb4feaf1566a8bbbde153"},{"fixed":"f0645cf53274e7ef6c17285a079673573c4e41c2"},{"introduced":"fdba4ca1398766e912f7888af5bdefbeef60d8b0"},{"last_affected":"6bd6f86d16eac5bcf20abe718916136eeafdda44"}],"database_specific":{"cpe":["cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","cpe:2.3:a:xwiki:xwiki:15.0:-:*:*:*:*:*:*","cpe:2.3:a:xwiki:xwiki:15.1:-:*:*:*:*:*:*"],"extracted_events":[{"introduced":"6.2"},{"fixed":"14.10.6"},{"introduced":"15.0-NA"},{"last_affected":"15.0-NA"},{"introduced":"15.1-NA"},{"last_affected":"15.1-NA"}],"source":["CPE_RANGE","CPE_STRING"]}},{"type":"GIT","repo":"https://github.com/xwiki/xwiki-platform","events":[{"introduced":"c427b927d0904c5989881dbf21d3f486eb0bf4ed"},{"fixed":"db1b7950037774552be2897571c2e1c5a7589400"},{"introduced":"96b4a230ee41ef74268c9720722f6473c705583d"},{"fixed":"46b542854978e9caa687a5c2b8817b8b17877d94"},{"fixed":"79418dd92ca11941b46987ef881bf50424898ff4"},{"fixed":"b0cdfd893912baaa053d106a92e39fa1858843c7"}],"database_specific":{"cpe":["cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","cpe:2.3:a:xwiki:xwiki:15.0:-:*:*:*:*:*:*","cpe:2.3:a:xwiki:xwiki:15.1:-:*:*:*:*:*:*"],"extracted_events":[{"introduced":"6.2"},{"fixed":"14.10.6"},{"introduced":"15.0-NA"},{"last_affected":"15.0-NA"},{"introduced":"15.1-NA"},{"last_affected":"15.1-NA"}],"source":["CPE_RANGE","CPE_STRING","REFERENCES"]}}],"versions":["15.0-NA","15.1-NA"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-36470.json","vanir_signatures_modified":"2026-08-12T14:51:06Z","vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/b0cdfd893912baaa053d106a92e39fa1858843c7","target":{"file":"xwiki-platform-core/xwiki-platform-icon/xwiki-platform-icon-default/src/main/java/org/xwiki/icon/internal/DefaultIconRenderer.java","function":"render"},"deprecated":false,"digest":{"function_hash":"167362306348135671665471178143531654629","length":457},"id":"CVE-2023-36470-05a32fdd"},{"deprecated":false,"digest":{"function_hash":"97482238270114087103089760096511428696","length":606},"id":"CVE-2023-36470-11cdc4c5","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/b0cdfd893912baaa053d106a92e39fa1858843c7","target":{"file":"xwiki-platform-core/xwiki-platform-icon/xwiki-platform-icon-default/src/test/java/org/xwiki/icon/internal/DefaultIconRendererTest.java","function":"render"}},{"target":{"file":"xwiki-platform-core/xwiki-platform-icon/xwiki-platform-icon-default/src/test/java/org/xwiki/icon/internal/VelocityRendererTest.java","function":"answer"},"deprecated":false,"digest":{"function_hash":"244834841169735561414933014385068961062","length":153},"id":"CVE-2023-36470-1404b7b6","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/b0cdfd893912baaa053d106a92e39fa1858843c7"},{"target":{"file":"xwiki-platform-core/xwiki-platform-icon/xwiki-platform-icon-default/src/test/java/org/xwiki/icon/internal/VelocityRendererTest.java","function":"setUp"},"deprecated":false,"digest":{"length":95,"function_hash":"337266517079331766163658824273480111348"},"id":"CVE-2023-36470-1982f835","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/b0cdfd893912baaa053d106a92e39fa1858843c7"},{"target":{"file":"xwiki-platform-core/xwiki-platform-icon/xwiki-platform-icon-default/src/main/java/org/xwiki/icon/internal/DefaultIconSetLoader.java"},"deprecated":false,"digest":{"line_hashes":["67565557627700931319228199702068503895","102984076788077792782370446247163018866","218964277863180905875782831767044594444","255325792764462768244064157664959706557","281672148073579728126160439180016115884","251685745378815514998577446902271292573","179348653741924404960218686654753005094","129279360994354527103964097920521079058","148393544456484234416988546984811695820","334184386895788389479022643325466803642","104496756352486077713390387785888925900","208342967799857750322793956743484688119","231005074527838624014931665711670087093","104738038848529217939404788543090788174","187747382649270175472320836876916228000","330713664893766228245058900886399418185","195195366465677549182838603185185637872","30079130123443132393567451961674218688","187914918929941156112000757286337158269","92389117636162400394182743585721169240","326944445460734839914372661613371868607"],"threshold":0.9},"id":"CVE-2023-36470-241d9ad3","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/b0cdfd893912baaa053d106a92e39fa1858843c7"},{"source":"https://github.com/xwiki/xwiki-platform/commit/b0cdfd893912baaa053d106a92e39fa1858843c7","target":{"function":"use","file":"xwiki-platform-core/xwiki-platform-icon/xwiki-platform-icon-default/src/main/java/org/xwiki/icon/internal/DefaultIconRenderer.java"},"deprecated":false,"digest":{"function_hash":"103383763363025819950474057596170166316","length":376},"id":"CVE-2023-36470-24d311a7","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2023-36470-26c69a40","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/b0cdfd893912baaa053d106a92e39fa1858843c7","target":{"file":"xwiki-platform-core/xwiki-platform-icon/xwiki-platform-icon-default/src/main/java/org/xwiki/icon/internal/VelocityRenderer.java","function":"render"},"deprecated":false,"digest":{"length":709,"function_hash":"294002460542796823325950598208654778809"}},{"id":"CVE-2023-36470-2c1eec71","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/b0cdfd893912baaa053d106a92e39fa1858843c7","target":{"file":"xwiki-platform-core/xwiki-platform-icon/xwiki-platform-icon-default/src/main/java/org/xwiki/icon/internal/DefaultIconRenderer.java"},"deprecated":false,"digest":{"line_hashes":["186257886105921465609961596766118795300","139468760374028263485783003857557406464","112373828094860435265442109265264482625","146597123566675978231324734126329141292","259475448993999329057619070662390118153","97970417009954173018239285044410082876","133606496443074809571464057606767679373","144905341468615933360973793916942193626","105559802686021836889246234123351026665","125343193288597049390395221357884331392","230867536206621499467341548929090653102","203679375360292437674541062547151746459","99026475264615959888631160073385941884","120233545785219953604249650514000990465","271592891843870900904336548306590462295","69669472497157927656661161062958484577","150433445100291173973268057411775310339","117087155363705637924915199155327030599","153885407916756547017568743525300856585","184240293772775492285718528050801700948","289050795764539028488064289187579087304","119259242082734671808718954609376667703","37375832830127780918741679491336021122","71227747639313315760167445830041107359"],"threshold":0.9}},{"digest":{"function_hash":"102276309859725490829606383330481707571","length":474},"id":"CVE-2023-36470-3d7de26c","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/b0cdfd893912baaa053d106a92e39fa1858843c7","target":{"function":"loadIconSetWithException","file":"xwiki-platform-core/xwiki-platform-icon/xwiki-platform-icon-default/src/test/java/org/xwiki/icon/internal/DefaultIconSetLoaderTest.java"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/b0cdfd893912baaa053d106a92e39fa1858843c7","target":{"file":"xwiki-platform-core/xwiki-platform-rendering/xwiki-platform-rendering-xwiki/src/test/java/org/xwiki/rendering/script/RenderingScriptServiceTest.java"},"deprecated":false,"digest":{"line_hashes":["33685260677850070333399814903615186429","123670860198531047804063892044240395509","214237272943969018425102057834421682742","105784309509016122854397709650390102781","139387483396833441521896498246038263252","306860258800819209345026815855391080618","74364373039251106110761614959734053343","326436653191459381459690772875657434611"],"threshold":0.9},"id":"CVE-2023-36470-3ed0e9ac","signature_type":"Line"},{"id":"CVE-2023-36470-478f31d6","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/b0cdfd893912baaa053d106a92e39fa1858843c7","target":{"file":"xwiki-platform-core/xwiki-platform-icon/xwiki-platform-icon-default/src/test/java/org/xwiki/icon/internal/DefaultIconRendererTest.java","function":"renderWithCSS"},"deprecated":false,"digest":{"function_hash":"286284374101782040912413866570687061235","length":644}},{"signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/b0cdfd893912baaa053d106a92e39fa1858843c7","target":{"function":"renderTest","file":"xwiki-platform-core/xwiki-platform-icon/xwiki-platform-icon-default/src/test/java/org/xwiki/icon/internal/VelocityRendererTest.java"},"deprecated":false,"digest":{"function_hash":"70340064962120365041964663244167492196","length":789},"id":"CVE-2023-36470-5e3488f6","signature_type":"Function"},{"target":{"file":"xwiki-platform-core/xwiki-platform-icon/xwiki-platform-icon-default/src/test/java/org/xwiki/icon/internal/DefaultIconSetLoaderTest.java","function":"setUp"},"deprecated":false,"digest":{"function_hash":"190295472167338414654205969289925550230","length":115},"id":"CVE-2023-36470-79bbe6d5","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/b0cdfd893912baaa053d106a92e39fa1858843c7"},{"signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/b0cdfd893912baaa053d106a92e39fa1858843c7","target":{"file":"xwiki-platform-core/xwiki-platform-icon/xwiki-platform-icon-default/src/test/java/org/xwiki/icon/internal/VelocityRendererTest.java","function":"renderWhenEvaluateReturnsFalse"},"deprecated":false,"digest":{"function_hash":"281410439375850729444933663625753814701","length":710},"id":"CVE-2023-36470-953e4fc5","signature_type":"Function"},{"signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/b0cdfd893912baaa053d106a92e39fa1858843c7","target":{"file":"xwiki-platform-core/xwiki-platform-icon/xwiki-platform-icon-default/src/test/java/org/xwiki/icon/internal/DefaultIconSetLoaderTest.java","function":"loadIconSetFromWikiDocumentWithException"},"deprecated":false,"digest":{"function_hash":"155223453898466444447458072301571237496","length":454},"id":"CVE-2023-36470-972c2baa","signature_type":"Function"},{"deprecated":false,"digest":{"line_hashes":["108738611910678758111537338281372079011","221624936547605104227952263841405386255","33977034592649684060272665255728904967","165144531513986220896745143083316767788","249342552812747742316725212642830826736","162512055982551606276086881299026403190","216562146874640400460183933490482372794","294929482346962534283399051375605999621","296443182975759111226471608742734734267","61054469069565289054665910772560138849","294735404397108524725704617372375661603","171266838345744622300115436486619484987","132948031446729690020677691695148902939","252032147907490673288270587013258006226","293810700328229211246102467954722395349","74290687273821017649348833554771578273","337658026094407268726461792352206388013","80358629296050429579348579092124479304","797866898877293196650509104305972471","108625188472984636751606576399834650077","115833332767376644681372461231557622926","118931906854021452592301432899324168878","207873988002434144204208216343036085954","202584809444324364360911147989491975972","254821005650451852520606435953436797022","251239674345814764202422174996868268409","160212957160613940221030345986448128937","81705407821086722947955685904025553073","45669203088458286483712704593657192369","6448902740635849345464506197789118761","15641995570274199624170187557922791843","274319311890237287559949108829238610448","313111391530559657579852521400086526749","325788153788404157234857809917017912968","325336748140608647505659432073450483916","252587606067350900371571882658025209911","208269031523186160932271542346574590220","291849537926416284886275612203478100930","108587633537507210242609878158511307392"],"threshold":0.9},"id":"CVE-2023-36470-98015481","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/b0cdfd893912baaa053d106a92e39fa1858843c7","target":{"file":"xwiki-platform-core/xwiki-platform-icon/xwiki-platform-icon-default/src/main/java/org/xwiki/icon/internal/VelocityRenderer.java"}},{"digest":{"function_hash":"329178531347279818962095115181884363010","length":866},"id":"CVE-2023-36470-a4329110","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/b0cdfd893912baaa053d106a92e39fa1858843c7","target":{"file":"xwiki-platform-core/xwiki-platform-icon/xwiki-platform-icon-rest/xwiki-platform-icon-rest-default/src/test/java/org/xwiki/icon/internal/DefaultIconThemesResourceTest.java","function":"getIconsIconManagerException"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"212622519290502770801948560799068724794","length":374},"id":"CVE-2023-36470-ad1ff1a0","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/b0cdfd893912baaa053d106a92e39fa1858843c7","target":{"file":"xwiki-platform-core/xwiki-platform-icon/xwiki-platform-icon-default/src/test/java/org/xwiki/icon/internal/VelocityRendererTest.java","function":"renderWithException"}},{"digest":{"function_hash":"26855377490642785531314238077087243585","length":236},"id":"CVE-2023-36470-b0ca02c5","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/b0cdfd893912baaa053d106a92e39fa1858843c7","target":{"file":"xwiki-platform-core/xwiki-platform-icon/xwiki-platform-icon-default/src/main/java/org/xwiki/icon/internal/DefaultIconRenderer.java","function":"activeCSS"},"deprecated":false},{"id":"CVE-2023-36470-b4e2b7e0","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/b0cdfd893912baaa053d106a92e39fa1858843c7","target":{"file":"xwiki-platform-core/xwiki-platform-icon/xwiki-platform-icon-default/src/test/java/org/xwiki/icon/internal/DefaultIconRendererTest.java","function":"renderHTMLWithCSS"},"deprecated":false,"digest":{"function_hash":"120993837924718924966488115955106462809","length":654}},{"target":{"file":"xwiki-platform-core/xwiki-platform-icon/xwiki-platform-icon-default/src/main/java/org/xwiki/icon/internal/DefaultIconRenderer.java","function":"activeJSX"},"deprecated":false,"digest":{"function_hash":"203844044787595970245504793749083586091","length":84},"id":"CVE-2023-36470-b4f85c91","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/b0cdfd893912baaa053d106a92e39fa1858843c7"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/b0cdfd893912baaa053d106a92e39fa1858843c7","target":{"function":"loadIconSet","file":"xwiki-platform-core/xwiki-platform-icon/xwiki-platform-icon-default/src/main/java/org/xwiki/icon/internal/DefaultIconSetLoader.java"},"deprecated":false,"digest":{"function_hash":"135008203413422514926709030187072464","length":474},"id":"CVE-2023-36470-bbc69b87"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/b0cdfd893912baaa053d106a92e39fa1858843c7","target":{"file":"xwiki-platform-core/xwiki-platform-icon/xwiki-platform-icon-default/src/test/java/org/xwiki/icon/internal/DefaultIconRendererTest.java","function":"renderHTML"},"deprecated":false,"digest":{"length":432,"function_hash":"259303389468083204480603995620573092579"},"id":"CVE-2023-36470-bdb24dee"},{"deprecated":false,"digest":{"function_hash":"83246499104815639892527676552548932873","length":444},"id":"CVE-2023-36470-be6bd85e","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/b0cdfd893912baaa053d106a92e39fa1858843c7","target":{"file":"xwiki-platform-core/xwiki-platform-icon/xwiki-platform-icon-default/src/test/java/org/xwiki/icon/internal/DefaultIconRendererTest.java","function":"renderWithException"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/b0cdfd893912baaa053d106a92e39fa1858843c7","target":{"file":"xwiki-platform-core/xwiki-platform-icon/xwiki-platform-icon-rest/xwiki-platform-icon-rest-default/src/test/java/org/xwiki/icon/internal/DefaultIconThemesResourceTest.java"},"deprecated":false,"digest":{"line_hashes":["237393447335847487204927714246557000966","173862205205381332092297619573661824990","47064045636163589897499611970842528437","166668652556785557941879370805903060957"],"threshold":0.9},"id":"CVE-2023-36470-c7cdf5c0"},{"deprecated":false,"digest":{"function_hash":"183129457557315886379864069111552303008","length":246},"id":"CVE-2023-36470-c8e65fdd","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/b0cdfd893912baaa053d106a92e39fa1858843c7","target":{"file":"xwiki-platform-core/xwiki-platform-icon/xwiki-platform-icon-default/src/test/java/org/xwiki/icon/internal/DefaultIconSetLoaderTest.java","function":"loadIconSet"}},{"id":"CVE-2023-36470-cdf45dac","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/b0cdfd893912baaa053d106a92e39fa1858843c7","target":{"file":"xwiki-platform-core/xwiki-platform-icon/xwiki-platform-icon-default/src/test/java/org/xwiki/icon/internal/DefaultIconSetLoaderTest.java","function":"loadIconSetFromWikiDocument"},"deprecated":false,"digest":{"function_hash":"318885475359250766967284981702448598767","length":734}},{"deprecated":false,"digest":{"length":86,"function_hash":"220899251335035183190622370947764694248"},"id":"CVE-2023-36470-ce58604b","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/b0cdfd893912baaa053d106a92e39fa1858843c7","target":{"file":"xwiki-platform-core/xwiki-platform-icon/xwiki-platform-icon-default/src/main/java/org/xwiki/icon/internal/DefaultIconRenderer.java","function":"activeSSX"}},{"target":{"file":"xwiki-platform-core/xwiki-platform-icon/xwiki-platform-icon-default/src/main/java/org/xwiki/icon/internal/DefaultIconSetManager.java"},"deprecated":false,"digest":{"line_hashes":["145464214587563524171426626519679311892","89623444479823822254177665001654473930","282241890043480848861773406111214411399","118523274149810776688638351509372205608","210796141075080754920562523681483064713","47716524359621369367123033394858408735","41434161359010349772524000039775676991","234676002825232882151377210770829652292","156254165669041495033746876102506487404","135848122679204205839860372868018422006","318908459016507843521628701561710287192","214762571048199052266028973209796071684","177536925284024579032684691027716447356","246664931803831466817669944234750803130","16440006600108845841779803802954560093","33321174043249903506919944934823258024","198887187794249589341410980262503115967","25757872282188661041839620028915285838","122064718394988455366800237944301768645","161754206596111572628652626874005483069","220809128566993099113668276955249924908","182473820597776269978021397002656500481","321383127403437247128882773196214067611","280668490039721225841722524302465782721","282118775004821563730659120351478006514","42182173149027336033724628704138231979","83328049848197040645831414870056420876","35476690641084653296287587734300187008","15136118611796208204539587487711436265","250344883881715470873571383966501339566","198424864568498951121995637816936953047","54978304795220021314113254036378280876","138004054475981371758833544026691777100","151361984606504914285711372679650313230","60043181745902932198394584151479368505"],"threshold":0.9},"id":"CVE-2023-36470-d667b091","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/b0cdfd893912baaa053d106a92e39fa1858843c7"},{"deprecated":false,"digest":{"line_hashes":["30576918382571963830229095977499524098","312269859637585696593759985122697587382","322540056360012579836002844305314255981","204063042478541680066769828259366776944","251597688942397798268804977785824143606","200518712878754524048043543788031298322","224766290158586798287126914570951638421","8196427614732457795538363817552457015","197966530045828850370921896118076789075","335591987792948281899890881148844267090","6087375694854643994638264223542976285","167063837693407771102498850190440734658","72936634736463236118907572067473317930","213912800661618832910835946379945710715","305527326240095256169823595326999622143","301754947803591789705693240206868623388","193863339280830290740218585423292517701","317844140753318475890505806452125159482","18967456857337440842104780593390099518","197271799645937272540923005506941775168","332622468063648687991474683074812414275","306713223649719378289232059425605954317","116065028348971185904935739100132417656","7930421488937791892301063289494481108","60483529170276289699454364962720648012"],"threshold":0.9},"id":"CVE-2023-36470-dc40ca88","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/b0cdfd893912baaa053d106a92e39fa1858843c7","target":{"file":"xwiki-platform-core/xwiki-platform-icon/xwiki-platform-icon-default/src/test/java/org/xwiki/icon/internal/DefaultIconRendererTest.java"}},{"deprecated":false,"digest":{"line_hashes":["96690812446091339856656471857597821134","335874827072146337420830158590572204840","339000298603414396751988950145560368333","318496629753024952972179588931282451156","112899936648506404315923173330305383788","280462942225917422670186474350750815924","117879382830857409886933442104205127289","252875466500864464521566321900293167438","168074424062572117827069704714427871027","263145974067752234610029089581572762734","280335006369351119505050881726117557761","315450827249570592065644203015520337753","208599258530884048506356133061863533435","231874719638575563023889309022847836301","36306805027669845309908568775714032795","111673430135588497563413423890805394189","35568124635204987056680169008288346393","57574151531087889962534711921397658723","248585046748960618112667909607551666349","201571600781246330720947636373985865366","285254002427107357793445905042714409435","153485535893426643763410465301781902802","259361805894148267697673970605270212970","253117620791626268312315050266296409591","142937389810574169025569164008165461820","25981167892543161926198272183417318035","11703755600359919290085960152080619374","218497183062740024092396281088676571842","191426642186971358190549067864045563928","215647769807706837761061601066482049918","184164382501220463344864099057924916972","91219122031793053717499861606947574209","224213926453000652841595940075174833583","26997630767991193738080815287163563646","168378230354428342702688751613298001187"],"threshold":0.9},"id":"CVE-2023-36470-e15a5176","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/b0cdfd893912baaa053d106a92e39fa1858843c7","target":{"file":"xwiki-platform-core/xwiki-platform-rendering/xwiki-platform-rendering-xwiki/src/main/java/org/xwiki/rendering/script/RenderingScriptService.java"}},{"id":"CVE-2023-36470-e208063a","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/b0cdfd893912baaa053d106a92e39fa1858843c7","target":{"file":"xwiki-platform-core/xwiki-platform-icon/xwiki-platform-icon-default/src/test/java/org/xwiki/icon/internal/DefaultIconSetLoaderTest.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["211158542113375481110727372067863135314","130599293719346514739688730330189867169","188813703809249892206883481246713784953","179922331306168593056232028339263086184","14678445647234583499537720731304526283","266327346398379888476719160279730584851","129376217015437656408283942362242080150","315830315562636633600160470007313012003","119967250458120485123076990488900347660","177328091334745574289971136321556843533","82024671910938414704304822380454489907","308423107115460905053613977459743676507","132426658199235778085679212435919208817","76607500846694852046093081196345678863","282428326106031468307600538784041527541","126737378997457359139087944659277048173","45699621699278768409644920769232346180","235577614361481394271673694746713117161","209847125475606158141358029563758050862","128828639124241604308954936925324807957","98054296929275487606132897993820746838","203555970910407852118722091887471897491","152394603578655913363220990305869543914","3527949497153392186689066981067331841","238859618644603946511984559711003718162","301671468773514852820307049771810850781","315452809724216153239640430466862377627","144774033380150334542002672371008277016","206279161045178860741753337029703457630","61421059264289658686875917412048893402","306485873171453058947943751315688201827","7183830391915741266590235579565626137","338482216160174938911216025411441198992","178598913642392041731895715141463616634","173494443270175307457028784735584743629","202379997326352987508264873991975796524","146667200644025606455829512324541099221","292121802995190270823054041517847155322","29229685354903024059394740288736497899","241968071933964375488343619480447240613","262880649771108072075891843893363844701","282253738453546037045212048734362327094","54434351741274519366174658750248437901","33494272432451521971941403309521064136","45322677844331077936925808193186082358","121080620950072108031073095692861149591","63162933369308239614083894555253133555","179483181696101369157474268815122647955","172855891843826655579849856870569660837","103434102998197940724407261660629760240","9993185289735005762473148100893269598","123163266279001453355821207979024451316","69383943864544471055454984767648579785","186674423103814571010453153348610636687","197109209444237398766596358409636085338","39621279458754060544519655499984371082","303821861175476878828825637815815285182","194729564453109444770553302982452892821","256511423561500492476005062416861685286","270273961383776642418188618523854461709","35984958886532018626352227675437236034","320281089815824262043181050803337195407","69091488806881486828329450299012983914","239814790395071902354262403008531048002","47127550471288068204607531905648287691","248642044170098773602426217774074376093","325427256418181669535161234892471023306","78109672075240834086072022418320782817","54845470225655733231155826216122981492","71459772199051927073413188092266617630","243045202816028015343189555751245971651","39621279458754060544519655499984371082","303821861175476878828825637815815285182","194729564453109444770553302982452892821","103805161142909142071193277121691520258","50143605146981450096354116684689098255","123365743435704215956968809450593773254"]}},{"digest":{"threshold":0.9,"line_hashes":["236928848963099058166833612312561018934","120802663149481107009396041066067327152"]},"id":"CVE-2023-36470-e7225ba6","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/b0cdfd893912baaa053d106a92e39fa1858843c7","target":{"file":"xwiki-platform-core/xwiki-platform-icon/xwiki-platform-icon-api/src/main/java/org/xwiki/icon/IconException.java"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"196023620501411330272750317238999479620","length":901},"id":"CVE-2023-36470-e98981d7","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/b0cdfd893912baaa053d106a92e39fa1858843c7","target":{"function":"getIconSet","file":"xwiki-platform-core/xwiki-platform-icon/xwiki-platform-icon-default/src/main/java/org/xwiki/icon/internal/DefaultIconSetManager.java"}},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["47583762062553743515792762667920106767","203060760975751620012110310395925713925","29166595586466143103290196561440396701","232818223395689470808586369942656888870","1309392453347303137534787259572628085","153436398388917634990831282276758814605","187752385065046682269065236476440180379","205775344043148942470550931084628024904","44075152038947740914178107884748118650","327165900178270848674473696945860471798","61537249934596584109812073954892198142","484283611899902708905911883326303725","51363734642771856416917991965760747538","201420541890806748796537672046349922755","272066079620147422531136348093232054019","26601917603189795462872632703316836597","250180496137074024504837494382553013432","307350852549596735308264438305448951197","252863084734793116189515014248231023770","34589815753410107818930711916879500759","186109735369133449235755459826816449054","324715300440100982128003324508679143380","146434968596548069201309197217190006379","262756610751541729305193554208824913179","179605799680808009595587151682223964748","250765960627504162926494928449144647490","157227629565539358415228057132385281489","192863654259262409969864728086140816174","158829087818798488892509252050027247123","302765466643995386986422695224786096692","257358414922649087894101362160825386201","286432562979915544429734044518601363097","280502722573347884425798524286900892378","328763015085373513808497787352099091394","258594572335800821148061865961055950531","58937985375866078715111589823785921627","79039670491061128657272426550555996116","212961328473754422340705901706482610719","193619107450926165811910963919631512387","8379590505717664852356424050796215821","238052066815752301958261322429244846933","215709952029037381212296719279831772964","48425340877146816828348494610561610073","186124625001613883501710011484041990710","135288289872642586703049897552015787202","48573548698879560651778013222928294508","25997969298049612925398642640147922119","220220947250717127781666171830343242857","44169084458251735576773413017502353340","179209148430151205533322404769641630463","195591775495898064395925349627075860826","237316637762058587230118982100257975739","70386169788011349011639261677476215111","106204619433042024500725818840397659515","145435376898612527603504793906014198839","54488193911535700678684446993015651937","23119393720216480399528648918191996311","26300718587436467204906828001080566610","275158909050259905391069653160268195925","63070623403452020338791057686340691215","138344095575444695857354078042604242880","92560043452840884382997121724699060414","21133393769305604301014180049701458979","275848413828005474473922107761172937186","324546494652047436171064011017297683623","232846281258360804055905818768896984075","106204619433042024500725818840397659515","145435376898612527603504793906014198839","54488193911535700678684446993015651937","23119393720216480399528648918191996311","259460032646307928465835147308958071648","213853047008405747857829669225736398153","115632643034891156580423747450386410787","228090489212725802532209265801993526111","132065215527646106608123518436167944368"]},"id":"CVE-2023-36470-ec497285","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/b0cdfd893912baaa053d106a92e39fa1858843c7","target":{"file":"xwiki-platform-core/xwiki-platform-icon/xwiki-platform-icon-default/src/test/java/org/xwiki/icon/internal/VelocityRendererTest.java"}},{"target":{"file":"xwiki-platform-core/xwiki-platform-icon/xwiki-platform-icon-default/src/test/java/org/xwiki/icon/internal/DefaultIconRendererTest.java","function":"renderIcon"},"deprecated":false,"digest":{"function_hash":"195219740566999636390562964949942726104","length":630},"id":"CVE-2023-36470-ee10ead6","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/b0cdfd893912baaa053d106a92e39fa1858843c7"},{"deprecated":false,"digest":{"line_hashes":["251816856439883356466173850753899216315","194414709720285015641874350573425099047","138888942579166172740564951312117847750","24539659342402662930335519148383183882","293484947848346056625464582884025331936","270332629011468227813332464288977672156","12683467672198662437737755101613696669","186043524403917319983291250580836686600","251006164710186369674579248992470178045","119095956572842698012316124600553959001","223146419939045870207886326347474781232","109616780365301586547457046836421337189","52242786640227147128316025189622878668","85161223570278908143513298283277201445","213539884163280630635112705011102504909","96859102654697794058044708591878389071","152008372085664651867498071190232762000","190016770894831229561761203769311600441"],"threshold":0.9},"id":"CVE-2023-36470-f7a8f293","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/b0cdfd893912baaa053d106a92e39fa1858843c7","target":{"file":"xwiki-platform-core/xwiki-platform-icon/xwiki-platform-icon-default/src/test/java/org/xwiki/icon/internal/DefaultIconSetManagerTest.java"}},{"digest":{"line_hashes":["27861632557942009497408468152215074305","229096197253406542089916657126794373557","93907919267517321169090627712232696399","112329200286804898104361452547609890554","232457829947828703443148803958968656822","176897285250181819160087933674260709383","22270232924366524853356568333473012096","15359252549495011470481274934977859774","239084025743096392165254422919849763486","244184168667629606899602979781634521218","248208178674563538030034906012656100138","191596742355564499590569903525085742007","117800230702513607024092018047137726104","25235806299350615832906416753739195337","177624343436457314670504522781211786204","85874908834254290659700327426166029361","271255115837404177023565723755490597462","140428380594162755743995639714774767516","124558016209159283481646161644822676820","182212813107894062488770441858783076376","191596742355564499590569903525085742007","117800230702513607024092018047137726104","181647660860353690582243581846950614079","292782863660767664032125060574126303688","214899081688534343951144310216753454313","73340829179273529681881744895011403643","270161507798638059892376100016552749060","24562272573100216375190806570649160730","322874919840593583307924229033941824302","191596742355564499590569903525085742007","117800230702513607024092018047137726104","287233042906784310196415293542426424084","286821204615302184236248106853686170878"],"threshold":0.9},"id":"CVE-2023-36470-f8930fa6","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/79418dd92ca11941b46987ef881bf50424898ff4","target":{"file":"xwiki-platform-core/xwiki-platform-icon/xwiki-platform-icon-script/src/main/java/org/xwiki/icon/IconManagerScriptService.java"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["178196986514532193319620878014093741053","156214401978161510015884732629814521608","62222566363147590560744992947397854381","249349813045502196285748639299514507553","104646086363849189943787613994782863942","180282307505276375475088207369014656211","117660104054054034053467241699253724165","24648757862496403107322822296546413047"],"threshold":0.9},"id":"CVE-2023-36470-fed5ef33","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/b0cdfd893912baaa053d106a92e39fa1858843c7","target":{"file":"xwiki-platform-core/xwiki-platform-icon/xwiki-platform-icon-api/src/main/java/org/xwiki/icon/IconSet.java"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}]}