Vulnerability Description
In XWiki before version 12.5 and 11.10.6, any user with SCRIPT right (EDIT right before XWiki 7.4) can gain access to the application server Servlet context which contains tools allowing to instantiate arbitrary Java objects and invoke methods that may lead to arbitrary code execution. This is patched in XWiki 12.5 and XWiki 11.10.6.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Xwiki | Xwiki | < 11.10.6 |
Related Weaknesses (CWE)
References
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-5hv6-mh8q-q9v8Third Party Advisory
- https://jira.xwiki.org/browse/XWIKI-17141ExploitVendor Advisory
- https://jira.xwiki.org/browse/XWIKI-17423Vendor Advisory
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-5hv6-mh8q-q9v8Third Party Advisory
- https://jira.xwiki.org/browse/XWIKI-17141ExploitVendor Advisory
- https://jira.xwiki.org/browse/XWIKI-17423Vendor Advisory
FAQ
What is CVE-2020-15252?
CVE-2020-15252 is a vulnerability with a CVSS score of 8.5 (HIGH). In XWiki before version 12.5 and 11.10.6, any user with SCRIPT right (EDIT right before XWiki 7.4) can gain access to the application server Servlet context which contains tools allowing to instantiat...
How severe is CVE-2020-15252?
CVE-2020-15252 has been rated HIGH with a CVSS base score of 8.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-15252?
Check the references section above for vendor advisories and patch information. Affected products include: Xwiki Xwiki.