GHSA-3738-p9x3-mv9r
XWiki Platform vulnerable to privilege escalation via properties with wiki syntax that are executed with wrong author
Quick fix
GHSA-3738-p9x3-mv9r — org.xwiki.platform:xwiki-platform-oldcore: upgrade to the fixed version with the command below.
# pom.xml: bump <version>13.10.11</version> for org.xwiki.platform:xwiki-platform-oldcoreDetails
### Impact
It's possible to use the right of an existing document content author to execute a text area property.
To reproduce:
* As an admin with programming rights, create a new user without script or programming right. * Login with the freshly created user. * Insert the following text in source mode in the about section: ``` {{groovy}}println("hello from groovy!"){{/groovy}} ``` * Click "Save & View"
### Patches
This has been patched in XWiki 14.10, 14.4.7, and 13.10.11.
### Workarounds
No known workaround.
### References https://jira.xwiki.org/browse/XWIKI-20373
### For more information If you have any questions or comments about this advisory:
* Open an issue in [Jira](http://jira.xwiki.org/) * Email us at [Security ML](mailto:security@xwiki.org)
Are you affected?
Enter the version of the package you're using.
Affected packages
13.10Fixed in: 13.10.11# pom.xml: bump <version>13.10.11</version> for org.xwiki.platform:xwiki-platform-oldcore13.10Fixed in: 13.10.11# pom.xml: bump <version>13.10.11</version> for org.xwiki.platform:xwiki-platform-legacy-oldcore14.0Fixed in: 14.4.7# pom.xml: bump <version>14.4.7</version> for org.xwiki.platform:xwiki-platform-oldcore14.0Fixed in: 14.4.7# pom.xml: bump <version>14.4.7</version> for org.xwiki.platform:xwiki-platform-legacy-oldcore14.5Fixed in: 14.10# pom.xml: bump <version>14.10</version> for org.xwiki.platform:xwiki-platform-oldcore14.5Fixed in: 14.10# pom.xml: bump <version>14.10</version> for org.xwiki.platform:xwiki-platform-legacy-oldcore