CVE-2021-32621
HIGH8.8EPSS 0.69%Script injection without script or programming rights through Gadget titles
發布日:2021/5/18修改日:2026/3/13
描述
### Impact A user without Script or Programming right is able to execute script requiring privileges by editing gadget titles in the dashboard. ### Patches The issue has been patched in XWiki 12.6.7, 12.10.3 and 13.0RC1. ### Workarounds There's no easy workaround for this issue, it is recommended to upgrade XWiki. ### References https://jira.xwiki.org/browse/XWIKI-17794 ### For more information If you have any questions or comments about this advisory: * Open an issue in [JIRA](https://jira.xwiki.org) * Email us at [XWiki security mailing-list](mailto:[email protected])
受影響套件(1)
- Maven/org.xwiki.commons:xwiki-commons-corefrom 0, < 12.6.7
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 3.1 | HIGH8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
參考連結(6)
- ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2021-32621
- PATCHhttps://github.com/xwiki/xwiki-platform
- WEBhttps://github.com/xwiki/xwiki-platform/commit/bb7068bd911f91e5511f3cfb03276c7ac81100bc
- WEBhttps://github.com/xwiki/xwiki-platform/security/advisories/GHSA-h353-hc43-95vc
- WEBhttps://jay-from-future.github.io/cve/2021/06/17/xwiki-rce-cve.html
- WEBhttps://jira.xwiki.org/browse/XWIKI-17794