GHSA-h5jm-jjgx-q2wf

    Dashboard / Vulnerabilities / GHSA-h5jm-jjgx-q2wf

    GHSA-h5jm-jjgx-q2wf

    Published: 1 May 2022Last Modified: 12 Feb 2024
    Aliases:
    CVE-2006-7223

    Summary: XWiki Remote Code Execution

    Details: PreviewAction in XWiki 0.9.543 through 0.9.1252 does not set the Author field to the identity of the user who last modified a document, which allows remote authenticated users without programming rights to execute arbitrary code by selecting a document whose author has programming rights, modifying this document to contain a script, and previewing without saving the document.

    References: https://nvd.nist.gov/vuln/detail/CVE-2006-7223, https://github.com/xwiki/xwiki-platform/commit/c44172a3556d12b62c0d793ab18475e5e13d7120, https://github.com/xwiki/xwiki-platform, https://web.archive.org/web/20080616064908/http://jira.xwiki.org/jira/browse/XWIKI-366

    Affected packages

    Package

    Name: org.xwiki.platform:xwiki-platform-oldcore

    Purl: pkg:maven/org.xwiki.platform/xwiki-platform-oldcore

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0.9.543
    Fixed -1.0B1

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-h5jm-jjgx-q2wf | CVE-DB