CVE-2023-29507
Published Apr 16, 2023
Last updated 2 years ago
Overview
- Description
- XWiki Commons are technical libraries common to several other top level XWiki projects. The Document script API returns directly a DocumentAuthors allowing to set any authors to the document, which in consequence can allow subsequent executions of scripts since this author is used for checking rights. The problem has been patched in XWiki 14.10 and 14.4.7 by returning a safe script API.
- Source
- security-advisories@github.com
- NVD status
- Analyzed
Risk scores
CVSS 3.1
- Type
- Primary
- Base score
- 7.2
- Impact score
- 5.9
- Exploitability score
- 1.2
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- Severity
- HIGH
Weaknesses
- nvd@nist.gov
- NVD-CWE-Other
- security-advisories@github.com
- CWE-648
Social media
- Hype score
- Not currently trending
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0E89251D-0CDC-4A0E-AB27-99063F6660B5",
"versionEndExcluding": "14.4.7",
"versionStartIncluding": "14.4.1"
},
{
"criteria": "cpe:2.3:a:xwiki:xwiki:14.10:rc1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0EC7DC4E-E9FD-407B-B95F-6CBD1B5E08E0"
}
],
"operator": "OR"
}
]
}
]