XWiki Remote Code Execution

GHSA-h5jm-jjgx-q2wf · CVE-2006-7223

Published May 1, 2022 · Modified Feb 12, 2024

Description

PreviewAction in XWiki 0.9.543 through 0.9.1252 does not set the Author field to the identity of the user who last modified a document, which allows remote authenticated users without programming rights to execute arbitrary code by selecting a document whose author has programming rights, modifying this document to contain a script, and previewing without saving the document.

References

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2006-7223
WEB https://github.com/xwiki/xwiki-platform/commit/c44172a3556d12b62c0d793ab18475e5e13d7120
PACKAGE https://github.com/xwiki/xwiki-platform
WEB https://web.archive.org/web/20080616064908/http://jira.xwiki.org/jira/browse/XWIKI-366

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes