PT-2007-1499 · Xwiki · Xwiki

Published 2007-09-14 · Updated 2022-05-01 · CVE-2006-7223

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions XWiki versions 0.9.543 through 0.9.1252

Description The issue allows remote authenticated users without programming rights to execute arbitrary code. This is achieved by selecting a document whose author has programming rights, modifying the document to contain a script, and then previewing the document without saving it.

Recommendations For XWiki versions 0.9.543 through 0.9.1252, consider restricting access to the PreviewAction feature until a proper fix is applied, ensuring that only authorized users can preview documents, especially those with programming rights. Additionally, limit the ability to modify documents to only those users who have been explicitly granted programming rights.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2006-7223

GHSA-H5JM-JJGX-Q2WF

Affected Products

Xwiki

References · 6

• https://osv.dev/vulnerability/GHSA-h5jm-jjgx-q2wf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-7223 · Security Note
• https://github.com/xwiki/xwiki-platform · Note
• https://github.com/xwiki/xwiki-platform/commit/c44172a3556d12b62c0d793ab18475e5e13d7120 · Note
• https://web.archive.org/web/20080616064908/http://jira.xwiki.org/jira/browse/XWIKI-366 · Note
• http://jira.xwiki.org/jira/browse/XWIKI-366 · Note