GHSA-pwfv-3cvg-9m4c
Suggest an improvement- Source
- https://github.com/advisories/GHSA-pwfv-3cvg-9m4c
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/04/GHSA-pwfv-3cvg-9m4c/GHSA-pwfv-3cvg-9m4c.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-pwfv-3cvg-9m4c
- Aliases
- Published
- 2023-04-12T20:36:28Z
- Modified
- 2023-11-08T04:12:19.348071Z
- Severity
-
- 9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
- Summary
- org.xwiki.platform:xwiki-platform-oldcore makes Incorrect Use of Privileged APIs with DocumentAuthors
- Details
-
Impact
The Document script API returns directly a DocumentAuthors allowing to set any authors to the document, which in consequence can allow subsequent executions of scripts since this author is used for checking rights. Example of such attack:
{{velocity}} $doc.setContent('{{velocity}}$xcontext.context.authorReference{{/velocity}}') $doc.authors.setContentAuthor('xwiki:XWiki.superadmin') $doc.getRenderedContent() {{/velocity}}Patches
The problem has been patched in XWiki 14.10 and 14.4.7 by returning a safe script API.
Workarounds
There no easy workaround apart of upgrading.
References
- https://jira.xwiki.org/browse/XWIKI-20380
- https://github.com/xwiki/xwiki-platform/commit/905cdd7c421dbf8c565557cdc773ab1aa9028f83
For more information
If you have any questions or comments about this advisory: * Open an issue in Jira * Email us at security ML
- Database specific
{ "nvd_published_at": "2023-04-16T07:15:00Z", "github_reviewed_at": "2023-04-12T20:36:28Z", "severity": "CRITICAL", "github_reviewed": true, "cwe_ids": [ "CWE-648" ] }- References
Affected packages
Maven / org.xwiki.platform:xwiki-platform-oldcore
Package
- Name
- org.xwiki.platform:xwiki-platform-oldcore
- View open source insights on deps.dev
- Purl
- pkg:maven/org.xwiki.platform/xwiki-platform-oldcore
Maven / org.xwiki.platform:xwiki-platform-oldcore
Package
- Name
- org.xwiki.platform:xwiki-platform-oldcore
- View open source insights on deps.dev
- Purl
- pkg:maven/org.xwiki.platform/xwiki-platform-oldcore