GitHub Advisoryadvisory · Maven

GHSA-9jq9-c2cv-pcrj Cross-site Scripting by SVG upload in xwiki-platform

MEDIUM Published 2022-02-10 Modified 2022-02-11 Official page ↗
Aliases
CVE-2021-43841
Ecosystem
Maven
Packages
org.xwiki.platform:xwiki-platform-oldcore, org.xwiki.platform:xwiki-platform-tool-configuration-resources
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N
Weaknesses
CWE-79
Reviewed
2022-02-07

Affected packages

• Maven org.xwiki.platform:xwiki-platform-oldcore: < 12.10.6 → fixed in 12.10.6 • Maven org.xwiki.platform:xwiki-platform-oldcore: >= 13.0, < 13.3RC1 → fixed in 13.3RC1 • Maven org.xwiki.platform:xwiki-platform-tool-configuration-resources: >= 13.0, < 13.3RC1 → fixed in 13.3RC1 • Maven org.xwiki.platform:xwiki-platform-tool-configuration-resources: < 12.10.6 → fixed in 12.10.6

Description

Impact When using default XWiki configuration, it's possible for an attacker to upload an SVG containing a script executed when executing the download action on the file. Patches This problem has been patched so that the default configuration doesn't allow to display the SVG files in the browser. Workarounds This issue can be fixed without the patch by setting properly the configuration to download or display files, see: https://www.xwiki.org/xwiki/bin/view/Documentation/AdminGuide/Attachments#HAttachmentdisplayordownload References https://jira.xwiki.org/browse/XWIKI-18368 For more information If you have any questions or comments about this advisory: • Open an issue in Jira • Email us at security ML

Related

Alias · CVE (1)

  • CVE-2021-43841 XWiki is a generic wiki platform offering runtime services for applications built on top of it. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References