CVE-2020-15171

In XWiki before versions 11.10.5 or 12.2.1, any user with SCRIPT right EDIT right before XWiki 7.4 can gain access to the application server Servlet context which contains tools allowing to instantiate arbitrary Java objects and invoke methods that may lead to arbitrary code execution. The only...

CVE-2020-15171

In XWiki before versions 11.10.5 or 12.2.1, any user with SCRIPT right EDIT right before XWiki 7.4 can gain access to the application server Servlet context which contains tools allowing to instantiate arbitrary Java objects and invoke methods that may lead to arbitrary code execution. The only...

CVE-2020-15171 Users with SCRIPT rights can execute arbitrary code in XWiki

In XWiki before versions 11.10.5 or 12.2.1, any user with SCRIPT right EDIT right before XWiki 7.4 can gain access to the application server Servlet context which contains tools allowing to instantiate arbitrary Java objects and invoke methods that may lead to arbitrary code execution. The only...

CVE-2020-15171

Vulnerability: CVE-2020-15171 affects XWiki before 11.10.5 and 12.2.1. A user with SCRIPT/EDIT rights (pre-7.4) can access the application server Servlet context and instantiate arbitrary Java objects or invoke methods, enabling arbitrary code execution. Affected components are XWiki’s web applic...