Incorrect Use of Privileged APIs in org.xwiki.platform.skin.skinx
Moderate severity
GitHub Reviewed
Published
Apr 8, 2022
in
xwiki/xwiki-platform
•
Updated Jan 27, 2023
Package
Affected versions
>= 13.5.0, < 13.10
< 12.10.11
>= 13.0.0, < 13.4.6
Patched versions
13.10
12.10.11
13.4.6
Description
Published by the National Vulnerability Database
Apr 8, 2022
Published to the GitHub Advisory Database
Apr 8, 2022
Reviewed
Apr 8, 2022
Last updated
Jan 27, 2023
Impact
Simple users can create global SSX/JSX without specific rights: in theory only users with Programming Rights should be allowed to create SSX or JSX that are executed everywhere on a wiki. But a bug allow anyone with edit rights to actually create those.
Patches
This issue has been patched in XWiki 13.10-rc-1, 12.10.11 and 13.4.6.
Workarounds
There's no easy workaround for this issue, administrators should upgrade their wiki.
References
https://jira.xwiki.org/browse/XWIKI-19155
For more information
If you have any questions or comments about this advisory:
References