GitHub Advisoryadvisory · Maven

GHSA-mgjw-2wrp-r535 Remote code execution in xwiki-platform

HIGH Published 2022-02-09 Modified 2022-02-09 Official page ↗
Aliases
CVE-2022-23616
Ecosystem
Maven
Packages
org.xwiki.platform:xwiki-platform-administration-ui
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-74
Reviewed
2022-02-09

Affected packages

• Maven org.xwiki.platform:xwiki-platform-administration-ui: >= 3.1-milestone-1, < 13.1RC1 → fixed in 13.1RC1

Description

Impact It's possible for an unprivileged user to perform a remote code execution by injecting a groovy script in her own profile and by calling the Reset password feature since the feature is performing a save of the user profile with programming rights in the impacted versions of XWiki. Patches The problem has been patched in XWiki 13.1RC1 with a complete refactoring of the Reset password feature. Workarounds There's different possible workarounds, all consisting in modifying the XWiki/ResetPassword page. • the Reset password feature can be entirely disabled by deleting the XWiki/ResetPassword page • the script in XWiki/ResetPassword can also be modified or removed: an administrator can replace it with a simple email contact to ask an administrator to reset the password. References https://jira.xwiki.org/browse/XWIKI-16661 For more information If you have any questions or comments about this advisory: • Open an issue in Jira • Email us at Security mailing-list

Related

Alias · CVE (1)

  • CVE-2022-23616 XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. vulnerability

Weakness · CWE (1)

  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness

References