Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

github логотип

GHSA-pwfv-3cvg-9m4c

Опубликовано: 12 апр. 2023
Источник: github
Github: Прошло ревью
CVSS3: 9.1

Описание

org.xwiki.platform:xwiki-platform-oldcore makes Incorrect Use of Privileged APIs with DocumentAuthors

Impact

The Document script API returns directly a DocumentAuthors allowing to set any authors to the document, which in consequence can allow subsequent executions of scripts since this author is used for checking rights. Example of such attack:

{{velocity}} $doc.setContent('{{velocity}}$xcontext.context.authorReference{{/velocity}}') $doc.authors.setContentAuthor('xwiki:XWiki.superadmin') $doc.getRenderedContent() {{/velocity}}

Patches

The problem has been patched in XWiki 14.10 and 14.4.7 by returning a safe script API.

Workarounds

There no easy workaround apart of upgrading.

References

For more information

If you have any questions or comments about this advisory:

Пакеты

Наименование

org.xwiki.platform:xwiki-platform-oldcore

maven
Затронутые версииВерсия исправления

>= 14.5, < 14.10

14.10

Наименование

org.xwiki.platform:xwiki-platform-oldcore

maven
Затронутые версииВерсия исправления

>= 14.4.1, < 14.4.7

14.4.7

EPSS

Процентиль: 77%
0.00991
Низкий

9.1 Critical

CVSS3

Дефекты

CWE-648

Связанные уязвимости

CVSS3: 9.1
nvd
почти 3 года назад

XWiki Commons are technical libraries common to several other top level XWiki projects. The Document script API returns directly a DocumentAuthors allowing to set any authors to the document, which in consequence can allow subsequent executions of scripts since this author is used for checking rights. The problem has been patched in XWiki 14.10 and 14.4.7 by returning a safe script API.

EPSS

Процентиль: 77%
0.00991
Низкий

9.1 Critical

CVSS3

Дефекты

CWE-648