In XWiki Platform, payloads stored in content is executed when a user with script/programming right edit them
Critical severity
GitHub Reviewed
Published
Aug 19, 2024
in
xwiki/xwiki-platform
•
Updated Aug 20, 2024
Package
Affected versions
< 15.10-rc-1
Patched versions
15.10-rc-1
Description
Published by the National Vulnerability Database
Aug 19, 2024
Published to the GitHub Advisory Database
Aug 19, 2024
Reviewed
Aug 19, 2024
Last updated
Aug 20, 2024
Credits
-
floerer Analyst
Impact
A user without script/programming right can trick a user with elevated rights to edit a content with a malicious payload using a WYSIWYG editor.
The user with elevated rights is not warned beforehand that they are going to edit possibly dangerous content.
The payload is executed at edit time.
Patches
This vulnerability has been patched in XWiki 15.10RC1.
Workarounds
No workaround. It is advised to upgrade to XWiki 15.10+.
References
For more information
If you have any questions or comments about this advisory:
Attribution
This vulnerability has been reported on Intigriti by @floerer
References