Description

XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with edit rights can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of the included pages in the included documents edit panel. The problem has been patched on XWiki 14.4.7, and 14.10.

Remediation

References

https://jira.xwiki.org/browse/XWIKI-20293

https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-c5f4-p5wv-2475

https://github.com/xwiki/xwiki-platform/commit/22f249a0eb9f2a64214628217e812a994419b69f#diff-a51a252f0190274464027342b4e3eafc4ae32de4d9c17ef166e54fc5454c5689R214-R217

Related Vulnerabilities

CVE-2021-23377 Vulnerability in npm package onion-oled-js

CVE-2020-8203 Vulnerability in maven package org.webjars.npm:lodash

CVE-2023-29205 Vulnerability in maven package org.xwiki.platform:xwiki-platform-rendering-xwiki

CVE-2020-7639 Vulnerability in npm package @eivifj/dot

CVE-2022-1365 Vulnerability in npm package cross-fetch

Severity

Critical

Classification

CWE-94 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Exploit Issue Tracking Patch Vendor Advisory