| Package | Affected versions | Patched versions |
|---|---|---|
| org.xwiki.commons:xwiki-commons-xml | ≥ 14.0-rc-1, < 14.4.4≥ 14.5, < 14.7-rc-1≥ 3.1-milestone-1, < 13.10.9 | 14.4.414.7-rc-113.10.9 |
| commons | = 14.4= 3.1= 3.1.1≥ 14.4, < 14.4.4≥ 14.5, < 14.7≥ 3.2, < 13.10.9 | 14.4.414.713.10.9 |
Any user can edit his own profile and inject code which is going to be executed with programming right.
Steps to reproduce:
{{cache id="userProfile"}}{{groovy}}println("Hello from groovy!"){{/groovy}}{{/cache}}
The first name appears as interpreted "Hello from groovy" instead of the expected fully escaped "{{cache id="userProfile"}}{{groovy}}println("Hello from groovy!"){{/groovy}}{{/cache}}".
The same vulnerability can also be exploited in all other places where short text properties are displayed, e.g., in apps created using Apps Within Minutes that use a short text field.
The problem has been patched on versions 13.10.9, 14.4.4, 14.7RC1.
There are no other workarounds than upgrading XWiki or patching the xwiki-commons-xml JAR file.
If you have any questions or comments about this advisory:
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free