CVE-2021-21379

    Dashboard / Vulnerabilities / CVE-2021-21379

    CVE-2021-21379

    Published: 12 Mar 2021Last Modified: 7 Aug 2026

    Summary:

    Details: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions of XWiki Platform, the `{{wikimacrocontent}}` executes the content with the rights of the wiki macro author instead of the caller of that wiki macro. This makes possible to inject scripts through it and they will be executed with the rights of the wiki macro (very often a user which has Programming rights). Fortunately, no such macro exists by default in XWiki Standard but one could have been created or installed with an extension. This vulnerability has been patched in versions XWiki 12.6.3, 11.10.11 and 12.8-rc-1. There is no easy workaround other than disabling the affected macros. Inserting content in a safe way or knowing what is the user who called the wiki macro is not easy.

    References: https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-v662-xpcc-9xf6, https://jira.xwiki.org/browse/XWIKI-17759

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 5a18b5ea0dc3a2e963592d3d377f8b24bef456b9
    Fixed -564b182d7f1ac2f4a377402aa6932c9fcb79f14a

    Affected versions

    xwiki-commons-12.7.1
    xwiki-commons-12.7

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-21379 | CVE-DB