CVE-2020-15171

Users with SCRIPT rights can execute arbitrary code in XWiki

State: Published
Severity: 6.6 Medium
Published: Sep 10, 2020
Updated: Aug 4, 2024
Reserved: Jun 25, 2020

Description

In XWiki before versions 11.10.5 or 12.2.1, any user with SCRIPT right (EDIT right before XWiki 7.4) can gain access to the application server Servlet context which contains tools allowing to instantiate arbitrary Java objects and invoke methods that may lead to arbitrary code execution. The only workaround is to give SCRIPT right only to trusted users.

Scores

CVSS	Score	Vector	Source
3.1	6.6 Medium	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H	GitHub_M

Weaknesses

CWE-94 Improper Control of Generation of Code ('Code Injection')

Affected Products

Product	Versions
xwiki-platformxwiki	<11.10.5Affected >=12.0.0, <12.2.1Affected

References

https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-7qw5-pqhc-xm4g

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.