org.xwiki.platform:xwiki-platform-attachment-ui vulnerable to Code Injection
Package
Affected versions
>= 3.0-rc-1, < 13.10.11
>= 14.0-rc-1, < 14.4.8
>= 14.5, < 14.10.2
Patched versions
13.10.11
14.4.8
14.10.2
Description
Published by the National Vulnerability Database
Apr 19, 2023
Published to the GitHub Advisory Database
Apr 20, 2023
Reviewed
Apr 20, 2023
Last updated
Nov 4, 2023
Impact
A registered user can perform remote code execution leading to privilege escalation by injecting the proper code in the "property" field of an attachment selector, as a gadget of their own dashboard. Note that the vulnerability does not impact comments of a wiki.
Patches
The vulnerability has been patched in XWiki 13.10.11, 14.4.8, 14.10.2, 15.0-rc-1.
Workarounds
The problem can be worked around by applying following changes directly in XWiki.AttachmentSelector page: xwiki/xwiki-platform@5e8725b.
References
For more information
If you have any questions or comments about this advisory:
References