XWiki Platform vulnerable to privilege escalation from view right on XWiki.AttachmentSelector
Critical severity
GitHub Reviewed
Published
Apr 18, 2023
in
xwiki/xwiki-platform
•
Updated Nov 4, 2023
Package
Affected versions
>= 2.0-rc-2, < 13.10.11
>= 14.0-rc-1, < 14.4.8
>= 14.5, < 14.10.1
Patched versions
13.10.11
14.4.8
14.10.1
Description
Published by the National Vulnerability Database
Apr 19, 2023
Published to the GitHub Advisory Database
Apr 20, 2023
Reviewed
Apr 20, 2023
Last updated
Nov 4, 2023
Impact
Any user with view rights on
XWiki.AttachmentSelectorcan execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping in the "Cancel and return to page" button. This page is installed by default.See https://jira.xwiki.org/browse/XWIKI-20275 for the reproduction steps.
Patches
The vulnerability has been patched in XWiki 15.0-rc-1, 14.10.1, 14.4.8, and 13.10.11.
Workarounds
The issue can be fixed by applying this patch on
XWiki.AttachmentSelector.References
For more information
If you have any questions or comments about this advisory:
References