What is GHSA-5hv6-mh8q-q9v8?

GHSA-5hv6-mh8q-q9v8 is a security advisory published by GitHub Security Advisories with High severity. RCE in XWiki

Which CVE IDs does GHSA-5hv6-mh8q-q9v8 cover?

GHSA-5hv6-mh8q-q9v8 covers the following CVE IDs: CVE-2020-15252. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-5hv6-mh8q-q9v8?

GHSA-5hv6-mh8q-q9v8 has a CVSS v3 base score of 8.5, published by GitHub Security Advisories.

Which products are affected by GHSA-5hv6-mh8q-q9v8?

GHSA-5hv6-mh8q-q9v8 affects 2 products, including: maven/org.xwiki.platform:xwiki-platform-oldcore:\u003c 11.10.6; maven/org.xwiki.platform:xwiki-platform-oldcore:\u003e= 12.0, \u003c 12.5.

GHSA-5hv6-mh8q-q9v8HighCVSS 8.5

RCE in XWiki

Vendor

GitHub Security Advisories

Published

October 16, 2020

Last Modified

February 1, 2023

🔗 CVE IDs covered (1)

CVE-2020-15252 →

📋 Description

Impact

Any user with SCRIPT right (EDIT right before XWiki 7.4) can gain access to the application server Servlet context which contains tools allowing to instantiate arbitrary Java objects and invoke methods that may lead to arbitrary code execution.

Patches

It has been patched in both version XWiki 12.5 and XWiki 11.10.6.

Workarounds

The only workaround is to give SCRIPT right only to trusted users.

References

https://jira.xwiki.org/browse/XWIKI-17423

It's been reported by the GitHub Security Lab under https://jira.xwiki.org/browse/XWIKI-17141.

For more information

If you have any questions or comments about this advisory:

Open an issue in Jira XWiki
Email us at our security mailing list

🎯 Affected products2

maven/org.xwiki.platform:xwiki-platform-oldcore:< 11.10.6
maven/org.xwiki.platform:xwiki-platform-oldcore:>= 12.0, < 12.5