Know every vulnerabilitybefore it knows you.
DevGuard continuously monitors your dependencies and alerts you when CVEs like this one affect your stack — with real-time threat intelligence built for developers.
GHSA-v662-xpcc-9xf6
No affected components available
Impact
The {{wikimacrocontent}} executes the content with the rights of the wiki macro author instead of the caller of that wiki macro. This makes possible to inject scripts through it and they will be executed with the rights of the wiki macro (very often a user which has Programming rights).
Fortunately, no such macro exists by default in XWiki Standard but one could have been created or installed with an extension.
Patches
It has been patched in versions XWiki 12.6.3, 11.10.11 and 12.8-rc-1.
Workarounds
There is no easy workaround other than disabling the affected macros. Inserting content in a safe way or knowing what is the user who called the wiki macro is not easy.
References
https://jira.xwiki.org/browse/XWIKI-17759
For more information
If you have any questions or comments about this advisory:
- Open an issue in Jira XWiki
- Email us at our security mailing list
Measures severity based on intrinsic characteristics of the vulnerability, independent of environment.
No exploitation activity has been observed at this time. Continue routine monitoring.
The exploit probability is very low. The vulnerability is unlikely to be exploited in the next 30 days.
We did not find any exploit available. Neither in GitHub repositories nor in the Exploit-Database.
Continuously monitor your dependencies and get alerted when vulnerabilities like this one affect your stack.
Checkout DevGuard