Home
HIGH: 8.5 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
affected
>= 16.5.0-rc-1, < 16.10.4
affected
>= 8.2, < 16.4.7
affected
>= 7.4.5, < 8.0-milestone-1
affected
Description
XWiki is a generic wiki platform. From 8.2 and 7.4.5 until 17.1.0-rc-1, 16.10.4, and 16.4.7, pages can gain script or programming rights when they contain a link and the target of the link is renamed or moved. This might lead to execution of scripts contained in xobjects that should have never been executed. This vulnerability is fixed in 17.1.0-rc-1, 16.10.4, and 16.4.7.
Problem types
CWE-266: Incorrect Privilege Assignment
Product status
>= 16.5.0-rc-1, < 16.10.4
>= 8.2, < 16.4.7
>= 7.4.5, < 8.0-milestone-1
References
github.com/...atform/security/advisories/GHSA-jm43-hrq7-r7w6
github.com/...ommit/ab209acd780da69a4c5ff77ff011efd698273cec
jira.xwiki.org/browse/XWIKI-22836