Vulnerability · Published Oct 16, 2020 · Assigned by GitHub_M
CVE-2020-15252RCE in XWiki
High 8.5
In plain English
A high-severity code injection in xwiki-platform from xwiki. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.4% (higher than 89% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
In XWiki before version 12.5 and 11.10.6, any user with SCRIPT right (EDIT right before XWiki 7.4) can gain access to the application server Servlet context which contains tools allowing to instantiate arbitrary Java objects and invoke methods that may lead to arbitrary code execution. This is patched in XWiki 12.5 and XWiki 11.10.6.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.xwiki.platform:xwiki-platform-oldcore | 11.10.6 | GHSA-5hv6-mh8q-q9v8 |
| Maven | org.xwiki.platform:xwiki-platform-oldcore | 12.5 | GHSA-5hv6-mh8q-q9v8 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| xwiki | xwiki-platform | >= 12.0, < 12.5< 11.10.6 |
Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
References
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-5hv6-mh8q-q9v8 x_refsource_CONFIRM
- https://jira.xwiki.org/browse/XWIKI-17141 x_refsource_MISC
- https://jira.xwiki.org/browse/XWIKI-17423 x_refsource_MISC