Lucene search
China National Vulnerability DatabaseCNVD-2022-86389HistoryNov 25, 2022 - 12:00 a.m.
XWiki Platform code injection vulnerability
2022-11-2500:00:00
China National Vulnerability Database
www.cnvd.org.cn
18
xwiki
code injection
vulnerability
macro
content
menu
groovy
python
velocity
cnvd
0.004 Low
EPSS
Percentile
73.9%
XWiki Platform is a Wiki platform for creating Web collaboration applications from the French company XWiki. XWiki Platform is vulnerable to code injection. The vulnerability stems from the macro content and menu macro parameters are not properly escaped, an attacker can use the vulnerability to execute arbitrary Groovy, Python or Velocity code.
| CPE | Name | Operator | Version |
|---|---|---|---|
| xwiki xwiki platform | lt | 13.10.8 | |
| xwiki xwiki platform | eq | 14.4.4 | |
| xwiki xwiki platform >=14.0.0， | lt | 14.4.3 | |
| xwiki xwiki platform | eq | 14.4.5 |
Related
openvas
openvas
github
github
cvelist
cvelist
osv
osv
Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in org.xwiki.platform:xwiki-platform-menu-ui
2022-11-21 22:37:27
CVE-2022-41934
2022-11-23 20:15:10
nvd
nvd
CVE-2022-41934
2022-11-23 20:15:10
cve
cve
CVE-2022-41934
2022-11-23 20:15:10
prion
prion
Design/Logic Flaw
2022-11-23 20:15:00