| Package | Affected versions | Patched versions |
|---|---|---|
| org.xwiki.commons:xwiki-commons-core | ≥ 12.10.0, < 12.10.3< 12.6.7 | 12.10.312.6.7 |
| xwiki | = 3.0≥ 12.10, < 12.10.3≥ 3.0.1, < 12.6.7 | 12.10.312.6.7 |
A user without Script or Programming right is able to execute script requiring privileges by editing gadget titles in the dashboard.
The issue has been patched in XWiki 12.6.7, 12.10.3 and 13.0RC1.
There's no easy workaround for this issue, it is recommended to upgrade XWiki.
https://jira.xwiki.org/browse/XWIKI-17794
If you have any questions or comments about this advisory:
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free