Issue List
VWE-2021-6051 is a MySQL Injection issue, where a malicious administrator can execute arbitrary MySQL statements by utilizing a flaw in integration position management. The issue affects VaultWiki 4.1.0 Alpha 1 and higher.VWE-2021-6076 is an HTML Injection issue, where a malicious editor can save specially crafted content that is later loaded as WYSIWYG editor content by an unsuspecting user editing the same page, and if the second user opens certain editor dialogs while having that content selected, the content can be displayed to the user unescaped. The issue affects all versions of the VaultWiki 4.x series.
VWE-2021-6087 is a Denial of Service issue, where a malicious editor can leverage fatal errors in handling of the WIDGET BB-Code's "sidebar" variant in order to cause any page they edit to resolve as a fatal error. The issue affects VaultWiki 4.1.0 Alpha 1 and higher, but only on XenForo 2.x platforms.
Patches
The following patches address the aforementioned issues:- 4.1.1 Patch Level 4
- 4.1.0 Patch Level 6
- 4.1.0 RC 3 Patch Level 8