What is GHSA-7qw5-pqhc-xm4g?

GHSA-7qw5-pqhc-xm4g is a security advisory published by GitHub Security Advisories with Low severity. Users with SCRIPT right can execute arbitrary code in XWiki

Which CVE IDs does GHSA-7qw5-pqhc-xm4g cover?

GHSA-7qw5-pqhc-xm4g covers the following CVE IDs: CVE-2020-15171. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-7qw5-pqhc-xm4g?

GHSA-7qw5-pqhc-xm4g has a CVSS v3 base score of 6.6, published by GitHub Security Advisories.

Which products are affected by GHSA-7qw5-pqhc-xm4g?

GHSA-7qw5-pqhc-xm4g affects 2 products, including: maven/org.xwiki.platform:xwiki-platform-oldcore:\u003c 11.10.5; maven/org.xwiki.platform:xwiki-platform-oldcore:\u003e= 12.0.0, \u003c 12.2.1.

GHSA-7qw5-pqhc-xm4gLowCVSS 6.6

Users with SCRIPT right can execute arbitrary code in XWiki

Vendor

GitHub Security Advisories

Published

September 10, 2020

Last Modified

February 1, 2023

🔗 CVE IDs covered (1)

CVE-2020-15171 →

📋 Description

Impact

Any user with SCRIPT right (EDIT right before XWiki 7.4) can gain access to the application server Servlet context which contains tools allowing to instantiate arbitrary Java objects and invoke methods that may lead to arbitrary code execution.

Patches

It has been patched in both version XWiki 12.2.1 and XWiki 11.10.5.

Workarounds

The only workaround is to give SCRIPT right only to trusted users.

References

https://jira.xwiki.org/browse/XWIKI-17141 https://jira.xwiki.org/browse/XWIKI-17266

It's been reported by the GitHub Security Lab under #GHSL-2020-046.

For more information

If you have any questions or comments about this advisory:

Open an issue in Jira XWiki
Email us at our security mailing list

🎯 Affected products2

maven/org.xwiki.platform:xwiki-platform-oldcore:< 11.10.5
maven/org.xwiki.platform:xwiki-platform-oldcore:>= 12.0.0, < 12.2.1