XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) into another syntax (XHTML, etc). Prior to versions 14.10.2 and 15.0 RC1, any user…
Critical CVSS 9.9
Summary
XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) into another syntax (XHTML, etc). Prior to versions 14.10.2 and 15.0 RC1, any user who can edit their own user profile or any other document can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. The reason is that rendering output is included as content of HTML mac…
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Sources
- NVD DATABASE
Original Links
- https://github.com/xwiki/xwiki-rendering/commit/92bc8095ed3acce15ab200c8525e1623b4898be5
- https://github.com/xwiki/xwiki-rendering/releases/tag/xwiki-rendering-14.10.2
- https://github.com/xwiki/xwiki-rendering/releases/tag/xwiki-rendering-15.0-rc-1
- https://github.com/xwiki/xwiki-rendering/security/advisories/GHSA-26vp-8gxg-v4pg
- https://jira.xwiki.org/browse/XRENDERING-693
- https://jira.xwiki.org/browse/XWIKI-20313
- https://jira.xwiki.org/browse/XWIKI-20327
Timeline
- nvd_ingest NVD