xwiki-platform-administration-ui vulnerable to privilege escalation (xwiki xwiki-platform)
En bref
- Source
- NVD
- EPSS
- EPSS 1.04 % · centile 64 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- GitHub_M
- Statut NVD
- Modified
Description
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with edit rights on a page (e.g., it's own user page), can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of the section ids in `XWiki.AdminFieldsDisplaySheet`. This page is installed by default. The vulnerability has been patched in XWiki versions 15.0-rc-1, 14.10.1, 14.4.8, and 13.10.11.
Faiblesses (CWE)
- CWE-95 — Injection via eval
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | CRITICAL 9.9 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L | GitHub_M |
| CVSS 3.1 | CRITICAL 9.9 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L | NVD · security-advisories@github.com (Secondary) |
| CVSS 3.1 | HIGH 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
Avis
- GHSA-rfh6-mg6h-h668 — xwiki-platform-administration-ui vulnerable to privilege escalation
Références européennes
- ENISA EUVD · EUVD-2023-1391
- GCVE · GCVE-0-2023-29511
Configurations affectées (CPE NVD)
cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*≥ 1.7 < 13.10.11cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*> 14.0 < 14.4.8cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*≥ 14.5 < 14.10.1cpe:2.3:a:xwiki:xwiki:14.0:-:*:*:*:*:*:*cpe:2.3:a:xwiki:xwiki:14.0:rc1:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| xwiki · xwiki-platform | affected >= 14.0-rc-1, < 14.4.8 ; affected >= 14.5, < 14.10.1 ; affected >= 1.5M2, < 13.10.11 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |