CVE-2021-32621
High
Description
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions prior to 12.6.7 and 12.10.3, a user without Script or Programming right is able to execute script requiring privileges by editing gadget titles in the dashboard. The issue has been patched in XWiki 12.6.7, 12.10.3 and 13.0RC1.
SeverityHigh
CVSS8.8
Exploit probability—
Product
Xwiki
PublishedMay 28, 2021
First seenMay 28, 2021
Weakness typeCWE-94Code injection
How to fix
Update
- xwiki xwiki12.6.7, 12.10.3 or later
- org.xwiki.commons:xwiki-commons-core12.6.7, 12.10.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| xwiki xwiki | 3.0.1 ≤ v < 12.6.7, 12.10 ≤ v < 12.10.3, 3.0 | 12.6.7, 12.10.3 |
| org.xwiki.commons:xwiki-commons-coreMaven | v < 12.6.7, 12.10.0 ≤ v < 12.10.3 | 12.6.7, 12.10.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.