1. Home
  2. CVE Database
  3. CVE-2020-15171
MEDIUM · 6.6

CVE-2020-15171

In XWiki before versions 11.10.5 or 12.2.1, any user with SCRIPT right (EDIT right before XWiki 7.4) can gain access to the application server Servlet context which contains tools allowing to instanti...

Vulnerability Description

In XWiki before versions 11.10.5 or 12.2.1, any user with SCRIPT right (EDIT right before XWiki 7.4) can gain access to the application server Servlet context which contains tools allowing to instantiate arbitrary Java objects and invoke methods that may lead to arbitrary code execution. The only workaround is to give SCRIPT right only to trusted users.

CVSS Score

6.6

MEDIUM

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
XwikiXwiki< 11.10.5

Related Weaknesses (CWE)

CWE-94CWE-74

References

FAQ

What is CVE-2020-15171?

CVE-2020-15171 is a vulnerability with a CVSS score of 6.6 (MEDIUM). In XWiki before versions 11.10.5 or 12.2.1, any user with SCRIPT right (EDIT right before XWiki 7.4) can gain access to the application server Servlet context which contains tools allowing to instanti...

How severe is CVE-2020-15171?

CVE-2020-15171 has been rated MEDIUM with a CVSS base score of 6.6/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2020-15171?

Check the references section above for vendor advisories and patch information. Affected products include: Xwiki Xwiki.