Vulnerability · Published May 28, 2021 · Assigned by GitHub_M

CVE-2021-32621Script injection without script or programming rights through Gadget titles

High 8.8

In plain English

A high-severity code injection in xwiki-platform from xwiki. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.1% (higher than 82% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)2.1%top 18.2% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions prior to 12.6.7 and 12.10.3, a user without Script or Programming right is able to execute script requiring privileges by editing gadget titles in the dashboard. The issue has been patched in XWiki 12.6.7, 12.10.3 and 13.0RC1.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	org.xwiki.commons:xwiki-commons-core	12.6.7	GHSA-h353-hc43-95vc
Maven	org.xwiki.commons:xwiki-commons-core	12.10.3	GHSA-h353-hc43-95vc

Affected products (as reported)

Vendor	Product	Versions
xwiki	xwiki-platform	< 12.6.7>= 12.10.0, < 12.10.3

Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-h353-hc43-95vc x_refsource_CONFIRM
https://jira.xwiki.org/browse/XWIKI-17794 x_refsource_MISC
https://github.com/xwiki/xwiki-platform/commit/bb7068bd911f91e5511f3cfb03276c7ac81100bc x_refsource_MISC
https://jay-from-future.github.io/cve/2021/06/17/xwiki-rce-cve.html x_refsource_MISC