PT-2021-14462 · Xwiki · Ratings Api+1

Simon Urli · Published 2021-03-23 · Updated 2021-03-24 · CVE-2021-21380

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions XWiki Platform versions prior to 12.9RC1

Description The XWiki Platform, specifically with the Ratings API installed, exposes an API that allows performing SQL requests without properly escaping the from and where search arguments. This could lead to SQL script injection for users with Script rights on XWiki.

Recommendations For versions prior to 12.9RC1, upgrade to XWiki 12.9RC1 to resolve the issue. As a temporary workaround, consider uninstalling the Ratings API in XWiki from the Extension Manager until a patch is applied.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-21380

GHSA-79RG-7MV3-JRR5

Affected Products

Ratings Api

Xwiki Platform

References · 9

• 🔥 https://github.com/rvermeulen/codeql-workshop-cve-2021-21380 · Exploit
• 🔥 https://github.com/advanced-security/codeql-workshop-cve-2021-21380 · Exploit
• https://osv.dev/vulnerability/CVE-2021-21380 · Vendor Advisory
• https://jira.xwiki.org/browse/XWIKI-17662 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-79rg-7mv3-jrr5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21380 · Security Note
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-79rg-7mv3-jrr5 · Note
• https://t.me/cvenotify/11847 · Telegram Post
• https://t.me/cibsecurity/25369 · Telegram Post