Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Privilege escalation (PR)/RCE from account through Invitation subject/message
Vulnerability Description
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user who can view `Invitation.WebHome` can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. This vulnerability has been patched on XWiki 14.4.8, 15.2-rc-1, and 14.10.6. Users are advised to upgrade. Users unable to upgrade may manually apply the patch on `Invitation.InvitationCommon` and `Invitation.InvitationConfig`, but there are otherwise no known workarounds for this vulnerability.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
Vulnerability Type
对生成代码的控制不恰当(代码注入)
Vulnerability Title
XWiki Platform 代码注入漏洞
Vulnerability Description
XWiki Platform是法国XWiki基金会的一套用于创建Web协作应用程序的Wiki平台。 XWiki Platform 存在代码注入漏洞，该漏洞源于任何能够查看Invitation.WebHome的用户都可以执行包括Groovy和Python宏在内的任意脚本宏，从而实现远程代码执行，包括对所有Wiki内容的无限制读写访问。
CVSS Information
N/A
Vulnerability Type
N/A