Most severe vulnerabilities for "xwiki xwiki" 12.9-rc1

Where

AND

Sort:

maven/org.xwiki.platform:xwiki-platform-like-uiXWiki Platform vulnerable to privilege escalation (PR) from account through like LiveTableResults

Risk 84

Severity

Code Injection

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Impact Any logged in user can add dangerous content in their first name field and see it executed with programming rights. Leading to rights escalation.

Patches The vulnerability has been fixed on XWiki 14.4.8, 14.10.6, and 15.1.

Workarounds The vulnerability can be fixed by applying this patch.

On versions before 13.4-rc-1, the fix needs to be applied on XWiki.Like.Code.LiveTableResultPage.

References - The reported issue https://jira.xwiki.org/browse/XWIKI-20611, fixed by https://jira.xwiki.org/browse/XWIKI-19900 - The patch https://github.com/xwiki/xwiki-platform/commit/6ce2d04a5779e07f6d3ed3f37d4761049b4fc3ac#diff-ef7f8b911bb8e584fda22aac5876a329add35ca0d1d32e0fdb62a439b78cfa49 For more information

If you have any questions or comments about this advisory: Open an issue in Jira XWiki.org Email us at Security Mailing List

1 / 2

First published (updated )

CVE-2023-35152

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.

Trending

maven/org.xwiki.platform:xwiki-platform-like-uiXWiki Platform vulnerable to privilege escalation (PR) from account through like LiveTableResults

Company

Resources

Contact