XWiki < 11.10.5, 12.x < 12.2.1 RCE Vulnerability

XWiki is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:xwiki:xwiki"; if...

Vulnerability fixed in XWiki

The developers of XWiki have fixed a vulnerability. A malicious person with SCRIPT privileges could exploit the vulnerability to gain access to the server's Instance Manager and thereby create arbitrary Java objects. The developers have released updates to fix the vulnerability fix in XWiki 12.2....

CVE-2020-15171

In XWiki before versions 11.10.5 or 12.2.1, any user with SCRIPT right EDIT right before XWiki 7.4 can gain access to the application server Servlet context which contains tools allowing to instantiate arbitrary Java objects and invoke methods that may lead to arbitrary code execution. The only...

CVE-2020-15171

In XWiki before versions 11.10.5 or 12.2.1, any user with SCRIPT right EDIT right before XWiki 7.4 can gain access to the application server Servlet context which contains tools allowing to instantiate arbitrary Java objects and invoke methods that may lead to arbitrary code execution. The only...

Code injection

In XWiki before versions 11.10.5 or 12.2.1, any user with SCRIPT right EDIT right before XWiki 7.4 can gain access to the application server Servlet context which contains tools allowing to instantiate arbitrary Java objects and invoke methods that may lead to arbitrary code execution. The only...

CVE-2020-15171 Users with SCRIPT rights can execute arbitrary code in XWiki

In XWiki before versions 11.10.5 or 12.2.1, any user with SCRIPT right EDIT right before XWiki 7.4 can gain access to the application server Servlet context which contains tools allowing to instantiate arbitrary Java objects and invoke methods that may lead to arbitrary code execution. The only...

CVE-2020-15171

Vulnerability: CVE-2020-15171 affects XWiki before 11.10.5 and 12.2.1. A user with SCRIPT/EDIT rights (pre-7.4) can access the application server Servlet context and instantiate arbitrary Java objects or invoke methods, enabling arbitrary code execution. Affected components are XWiki’s web applic...

GHSA-7QW5-PQHC-XM4G Users with SCRIPT right can execute arbitrary code in XWiki

Impact Any user with SCRIPT right EDIT right before XWiki 7.4 can gain access to the application server Servlet context which contains tools allowing to instantiate arbitrary Java objects and invoke methods that may lead to arbitrary code execution. Patches It has been patched in both version XWi...

Users with SCRIPT right can execute arbitrary code in XWiki

Impact Any user with SCRIPT right EDIT right before XWiki 7.4 can gain access to the application server Servlet context which contains tools allowing to instantiate arbitrary Java objects and invoke methods that may lead to arbitrary code execution. Patches It has been patched in both version XWi...

XWiki Platform Code Injection Vulnerability

XWiki Platform is the French company XWiki's set of Wiki platform for creating Web collaboration applications. A code injection vulnerability exists in XWiki Platform versions 7.2 through 11.10.2 fixed in versions 11.3.7, 11.10.3, and 12.0. An attacker can exploit the vulnerability to execute...

CVE-2020-11057

In XWiki Platform 7.2 through 11.10.2, registered users without scripting/programming permissions are able to execute python/groovy scripts while editing personal dashboards. This has been fixed 11.3.7 , 11.10.3 and 12.0...

CVE-2020-11057

In XWiki Platform 7.2 through 11.10.2, registered users without scripting/programming permissions are able to execute python/groovy scripts while editing personal dashboards. This has been fixed 11.3.7 , 11.10.3 and 12.0...

Code injection

In XWiki Platform 7.2 through 11.10.2, registered users without scripting/programming permissions are able to execute python/groovy scripts while editing personal dashboards. This has been fixed 11.3.7 , 11.10.3 and 12.0...

CVE-2020-11057

In XWiki Platform, CVE-2020-11057 describes a code-injection risk where registered users without scripting/programming permissions could execute Python/Groovy scripts while editing personal dashboards. Affects versions 7.2–11.10.2. The underlying flaw enabled script execution during dashboard edi...

CVE-2020-11057 Code Injection in XWiki Platform

In XWiki Platform 7.2 through 11.10.2, registered users without scripting/programming permissions are able to execute python/groovy scripts while editing personal dashboards. This has been fixed 11.3.7 , 11.10.3 and 12.0...

CVE-2019-15302

The pad management logic in XWiki labs CryptPad before 3.0.0 allows a remote attacker who has access to a Rich Text pad with editing rights for the URL to corrupt it i.e., cause data loss via a trivial URL modification...

CVE-2019-15302

The pad management logic in XWiki labs CryptPad before 3.0.0 allows a remote attacker who has access to a Rich Text pad with editing rights for the URL to corrupt it i.e., cause data loss via a trivial URL modification...

Design/Logic Flaw

The pad management logic in XWiki labs CryptPad before 3.0.0 allows a remote attacker who has access to a Rich Text pad with editing rights for the URL to corrupt it i.e., cause data loss via a trivial URL modification...

CVE-2019-15302

The pad management logic in XWiki labs CryptPad before 3.0.0 allows a remote attacker who has access to a Rich Text pad with editing rights for the URL to corrupt it i.e., cause data loss via a trivial URL modification...

CVE-2019-15302

The CVE-2019-15302 issue affects XWiki Labs CryptPad prior to 3.0.0. The pad management logic for Rich Text pads allows a remote attacker with editing rights for a pad’s URL to corrupt the pad (data loss) via a trivial URL modification. The description notes the vulnerability outcome as data loss...