GHSA-h5jm-jjgx-q2wfMedium

XWiki Remote Code Execution

Published
May 1, 2022
Last Modified
February 12, 2024

🔗 CVE IDs covered (1)

CVE-2006-7223 →

📋 Description

PreviewAction in XWiki 0.9.543 through 0.9.1252 does not set the Author field to the identity of the user who last modified a document, which allows remote authenticated users without programming rights to execute arbitrary code by selecting a document whose author has programming rights, modifying this document to contain a script, and previewing without saving the document.

🎯 Affected products1

  • maven/org.xwiki.platform:xwiki-platform-oldcore:>= 0.9.543, <= 0.9.1252

🔗 References (4)