Script injection without script or programming rights through Gadget titles

ALTO 8.8CVE-2021-32621 · GHSA-h353-hc43-95vc · Published 28/05/2021 · updated 17/06/2026

In breve

CVE-2021-32621 è una vulnerabilità ALTO (CVSS 8.8) che riguarda org.xwiki.commons:xwiki-commons-core, xwiki (xwiki).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 2.1%, superiore al 81.7% delle vulnerabilità.
Correzione: aggiornare a 12.10.3, 12.6.7 o successiva.

Package	Affected versions	Patched versions
org.xwiki.commons:xwiki-commons-core Maven	`≥ 12.10.0, < 12.10.3< 12.6.7`	`12.10.312.6.7`
xwiki xwiki	`= 3.0≥ 12.10, < 12.10.3≥ 3.0.1, < 12.6.7`	`12.10.312.6.7`

Description

Impact

A user without Script or Programming right is able to execute script requiring privileges by editing gadget titles in the dashboard.

Patches

The issue has been patched in XWiki 12.6.7, 12.10.3 and 13.0RC1.

Workarounds

There's no easy workaround for this issue, it is recommended to upgrade XWiki.

References

https://jira.xwiki.org/browse/XWIKI-17794

For more information

If you have any questions or comments about this advisory:

Open an issue in JIRA
Email us at XWiki security mailing-list

NVD description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions prior to 12.6.7 and 12.10.3, a user without Script or Programming right is able to execute script requiring privileges by editing gadget titles in the dashboard. The issue has been patched in XWiki 12.6.7, 12.10.3 and 13.0RC1.

References

xwiki/xwiki-platform security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2021-32621 · ADVISORY
xwiki/xwiki-platform commit bb7068b · WEB
xwiki/xwiki-platform · PACKAGE
jay-from-future.github.io/cve/2021/06/17/xwiki-rce-cve.html · WEB
jira.xwiki.org/browse/XWIKI-17794 · WEB

Altre vulnerabilità di org.xwiki.commons:xwiki-commons-core

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.xwiki.commons:xwiki-commons-core

Maven

≥ 12.10.0, < 12.10.3< 12.6.7

12.10.312.6.7

xwiki

= 3.0≥ 12.10, < 12.10.3≥ 3.0.1, < 12.6.7

12.10.312.6.7

Description

Impact

A user without Script or Programming right is able to execute script requiring privileges by editing gadget titles in the dashboard.

Patches

The issue has been patched in XWiki 12.6.7, 12.10.3 and 13.0RC1.

Workarounds

There's no easy workaround for this issue, it is recommended to upgrade XWiki.

References

https://jira.xwiki.org/browse/XWIKI-17794

For more information

If you have any questions or comments about this advisory:

Open an issue in JIRA
Email us at XWiki security mailing-list

NVD description