Description

PreviewAction in XWiki 0.9.543 through 0.9.1252 does not set the Author field to the identity of the user who last modified a document, which allows remote authenticated users without programming rights to execute arbitrary code by selecting a document whose author has programming rights, modifying this document to contain a script, and previewing without saving the document.

Remediation

References

CVE-2006-7223

Related Vulnerabilities

Atlassian Confluence Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2017-18086)

WordPress Plugin Email Subscribers by Icegram Express-Email Marketing, Newsletters, Automation for WordPress & WooCommerce Security Bypass (4.5.5)

WordPress Plugin SEO Redirection-301 Redirect Manager SQL Injection (3.5)

WordPress Plugin Altos Connect Widget Cross-Site Scripting (1.3.0)

XWiki Inadequate Encryption Strength Vulnerability (CVE-2022-29161)

Severity

Medium

Classification

CVE-2006-7223 CWE-264

Tags

Missing Update Known Vulnerabilities