CVE-2023-29211

Опубликовано: 16 апр. 2023

Источник: nvd

CVSS3: 9.9

CVSS3: 8.8

EPSS Низкий

Описание

XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with view rights WikiManager.DeleteWiki can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of the wikiId url parameter. The problem has been patched on XWiki 13.10.11, 14.4.7, and 14.10.

Ссылки

https://github.com/xwiki/xwiki-platform/commit/ba4c76265b0b8a5e2218be400d18f08393fe1428#diff-64f39f5f2cc8c6560a44e21a5cfd509ef00e8a2157cd9847c9940a2e08ea43d1R63-R64
Patch
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-w7v9-fc49-4qg4
Exploit
Patch
Vendor Advisory
https://jira.xwiki.org/browse/XWIKI-20297
Exploit
Issue Tracking
https://github.com/xwiki/xwiki-platform/commit/ba4c76265b0b8a5e2218be400d18f08393fe1428#diff-64f39f5f2cc8c6560a44e21a5cfd509ef00e8a2157cd9847c9940a2e08ea43d1R63-R64
Patch
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-w7v9-fc49-4qg4
Exploit
Patch
Vendor Advisory
https://jira.xwiki.org/browse/XWIKI-20297
Exploit
Issue Tracking

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*

Версия до 13.10.11 (исключая)

cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*

Версия от 14.4.0 (включая) до 14.4.7 (исключая)

cpe:2.3:a:xwiki:xwiki:14.10:rc1:*:*:*:*:*:*

EPSS

Процентиль: 92%

0.08238

Низкий

9.9 Critical

CVSS3

8.8 High

CVSS3

Дефекты

CWE-95

CWE-94

Связанные уязвимости

GHSA-w7v9-fc49-4qg4

CVSS3: 9.9

github

почти 3 года назад

org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki Eval Injection vulnerability

EPSS

Процентиль: 92%

0.08238

Низкий

9.9 Critical

CVSS3

8.8 High

CVSS3

Дефекты

CWE-95

CWE-94