CVE-2006-7223
Medium
Description
PreviewAction in XWiki 0.9.543 through 0.9.1252 does not set the Author field to the identity of the user who last modified a document, which allows remote authenticated users without programming rights to execute arbitrary code by selecting a document whose author has programming rights, modifying this document to contain a script, and previewing without saving the document.
SeverityMedium
CVSS6.5
Exploit probability—
Product
Xwiki
PublishedSep 14, 2007
First seenSep 14, 2007
How to fix
Update
- org.xwiki.platform:xwiki-platform-oldcore1.0B1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| xwiki xwiki | 0.9.543, 0.9.790, 0.9.793, 0.9.840, 0.9.1252 | — |
| org.xwiki.platform:xwiki-platform-oldcoreMaven | 0.9.543 ≤ v < 1.0B1 | 1.0B1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.