Vulnerability · Published May 12, 2020 · Assigned by GitHub_M
CVE-2020-11057Code Injection in XWiki Platform
Critical 9.9
In plain English
A critical-severity code injection in XWiki Platform from xwiki. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.2% (higher than 82% of all known vulnerabilities).
Severity (CVSS 3.1)9.9Critical
Exploit odds (30 days)2.2%top 17.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
In XWiki Platform 7.2 through 11.10.2, registered users without scripting/programming permissions are able to execute python/groovy scripts while editing personal dashboards. This has been fixed 11.3.7 , 11.10.3 and 12.0.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| xwiki | XWiki Platform | >= 7.2, < 11.10.3 |
Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
References
- https://medium.com/%40andrew.levkin/tews-4c47cfc011d1 x_refsource_MISC
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-rmp6-jjg8-9424 x_refsource_CONFIRM
- https://jira.xwiki.org/browse/XWIKI-16960 x_refsource_MISC