GHSA-jgrg-qvpp-9vwr
Suggest an improvement- Source
- https://github.com/advisories/GHSA-jgrg-qvpp-9vwr
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/04/GHSA-jgrg-qvpp-9vwr/GHSA-jgrg-qvpp-9vwr.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-jgrg-qvpp-9vwr
- Aliases
- Published
- 2023-04-20T22:25:02Z
- Modified
- 2023-11-08T04:12:20.569862Z
- Severity
-
- 9.9 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
- Summary
- XWiki Platform vulnerable to code injection from account through AWM view sheet
- Details
-
Impact
Steps to reproduce:
- As a user without script or programming right, edit your user profile (or any other document) with the wiki editor and add the content
{{groovy}}println("Hello " + "from Groovy!"){{/groovy}} - Edit the document with the object editor and add an object of type AppWithinMinutes.LiveTableClass (no values need to be set, just save)
- View the document
Patches
The vulnerability has been patched in XWiki 15.0-rc-1 and 14.10.3.
Workarounds
There is no known workaround.
References
https://jira.xwiki.org/browse/XWIKI-20423
For more information
If you have any questions or comments about this advisory: * Open an issue in Jira XWiki.org * Email us at Security Mailing List
- As a user without script or programming right, edit your user profile (or any other document) with the wiki editor and add the content
- Database specific
{ "github_reviewed": true, "severity": "CRITICAL", "nvd_published_at": "2023-04-19T00:15:09Z", "cwe_ids": [ "CWE-74" ], "github_reviewed_at": "2023-04-20T22:25:02Z" }- References
Affected packages
Maven / org.xwiki.platform:xwiki-platform-appwithinminutes-ui
Package
- Name
- org.xwiki.platform:xwiki-platform-appwithinminutes-ui
- View open source insights on deps.dev
- Purl
- pkg:maven/org.xwiki.platform/xwiki-platform-appwithinminutes-ui