medium6.5
CVE-2006-7223
XWiki Remote Code Execution
Impact
PreviewAction in XWiki 0.9.543 through 0.9.1252 does not set the Author field to the identity of the user who last modified a document, which allows remote authenticated users without programming rights to execute arbitrary code by selecting a document whose author has programming rights, modifying this document to contain a script, and previewing without saving the document.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.xwiki.platform:xwiki-platform-oldcore | >= 0.9.543, <= 0.9.1252 | 1.0B1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Xwiki | Xwiki | Versions 0.9.543, 0.9.790, 0.9.793, 0.9.840, 0.9.1252 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- http://jira.xwiki.org/jira/browse/XWIKI-366
- https://github.com/advisories/GHSA-h5jm-jjgx-q2wf
- https://nvd.nist.gov/vuln/detail/CVE-2006-7223
- https://github.com/xwiki/xwiki-platform/commit/c44172a3556d12b62c0d793ab18475e5e13d7120
- https://web.archive.org/web/20080616064908/http://jira.xwiki.org/jira/browse/XWIKI-366