| Package | Affected versions | Patched versions |
|---|---|---|
| org.xwiki.platform:xwiki-platform-skin-skinx | ≥ 13.0.0, < 13.4.6≥ 13.5.0, < 13.10< 12.10.11 | 13.4.613.1012.10.11 |
| xwiki | = 13.10≥ 12.0.0, < 12.10.11≥ 13.4.0, < 13.4.6 | 12.10.1113.4.6 |
Simple users can create global SSX/JSX without specific rights: in theory only users with Programming Rights should be allowed to create SSX or JSX that are executed everywhere on a wiki. But a bug allow anyone with edit rights to actually create those.
This issue has been patched in XWiki 13.10-rc-1, 12.10.11 and 13.4.6.
There's no easy workaround for this issue, administrators should upgrade their wiki.
https://jira.xwiki.org/browse/XWIKI-19155
If you have any questions or comments about this advisory:
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free