XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki supports scheduled jobs that contain Groovy scripts. Currently, the job checks the content author of the job for programming right. However, modifying or adding a job script to a document doesnt modify the content author. Together with a CSRF vulnerability in the job scheduler, this can be exploited for remote code execution by an attacker with edit right on the wiki. If the attack is successful, an error log entry with Job content executed will be produced. This vulnerability has been patched in XWiki 14.10.9 and 15.4RC1.
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Xwiki | Xwiki | * | 14.10.9 (excluding) |
| Xwiki | Xwiki | 15.0 (including) | 15.0 (including) |
| Xwiki | Xwiki | 15.0-rc1 (including) | 15.0-rc1 (including) |
| Xwiki | Xwiki | 15.1 (including) | 15.1 (including) |
| Xwiki | Xwiki | 15.1-rc1 (including) | 15.1-rc1 (including) |
| Xwiki | Xwiki | 15.2 (including) | 15.2 (including) |
| Xwiki | Xwiki | 15.2-rc1 (including) | 15.2-rc1 (including) |
| Xwiki | Xwiki | 15.3 (including) | 15.3 (including) |
| Xwiki | Xwiki | 15.3-rc1 (including) | 15.3-rc1 (including) |
Access control involves the use of several protection mechanisms such as:
When any mechanism is not applied or otherwise fails, attackers can compromise the security of the product by gaining privileges, reading sensitive information, executing commands, evading detection, etc. There are two distinct behaviors that can introduce access control weaknesses: