GHSA-h5jm-jjgx-q2wf
XWiki Remote Code Execution
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.xwiki.platform:xwiki-platform-oldcore | >= 0.9.543, < 1.0B1 | 1.0B1 |
Details
As written in the advisory (Markdown source, shown as plain text).
PreviewAction in XWiki 0.9.543 through 0.9.1252 does not set the Author field to the identity of the user who last modified a document, which allows remote authenticated users without programming rights to execute arbitrary code by selecting a document whose author has programming rights, modifying this document to contain a script, and previewing without saving the document.
References
External links from the advisory. They lead to third-party sites.