1. Home
  2. Security Advisories
  3. Maven
  4. MAVEN:GHSA-H353-HC43-95VC

[MAVEN:GHSA-H353-HC43-95VC] Script injection without script or programming rights through Gadget titles

Severity High
Affected Packages 2
Fixed Packages 2
CVEs 1
Info Packages References Vulnerabilities

Impact

A user without Script or Programming right is able to execute script requiring privileges by editing gadget titles in the dashboard.

Patches

The issue has been patched in XWiki 12.6.7, 12.10.3 and 13.0RC1.

Workarounds

There's no easy workaround for this issue, it is recommended to upgrade XWiki.

References

https://jira.xwiki.org/browse/XWIKI-17794

For more information

If you have any questions or comments about this advisory:
* Open an issue in JIRA
* Email us at XWiki security mailing-list

Package Affected Version
pkg:maven/org.xwiki.commons/xwiki-commons-core >= 12.10.0, < 12.10.3
pkg:maven/org.xwiki.commons/xwiki-commons-core < 12.6.7
Package Fixed Version
pkg:maven/org.xwiki.commons/xwiki-commons-core = 12.10.3
pkg:maven/org.xwiki.commons/xwiki-commons-core = 12.6.7
ID
MAVEN:GHSA-H353-HC43-95VC
Severity
high
URL
https://github.com/advisories/GHSA-h353-hc43-95vc
Published
2021-05-18T18:36:16
(3 years ago)
Modified
2023-09-29T20:11:43
(11 months ago)
Rights
Maven Security Team
Type Package URL Namespace Name / Product Version Distribution / Platform Arch Patch / Fix
Affected pkg:maven/org.xwiki.commons/xwiki-commons-core org.xwiki.commons xwiki-commons-core >= 12.10.0 < 12.10.3
Fixed pkg:maven/org.xwiki.commons/xwiki-commons-core org.xwiki.commons xwiki-commons-core = 12.10.3
Affected pkg:maven/org.xwiki.commons/xwiki-commons-core org.xwiki.commons xwiki-commons-core < 12.6.7
Fixed pkg:maven/org.xwiki.commons/xwiki-commons-core org.xwiki.commons xwiki-commons-core = 12.6.7
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories Exploits PoC Pubblication Date Modification Date
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories PoC Pubblication Date Modification Date