PT-2022-16129
CVE-2022-23616
·
تاريخ النشر
2022-02-09
·
تاريخ التحديث
2022-02-15
الوصف من
CVSS 3.1
8.8
عاليةالمقاييسAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
XWiki Platform versions prior to 13.1RC1
Description
The issue allows an unprivileged user to perform a remote code execution by injecting a groovy script in her own profile and by calling the Reset password feature, as it performs a save of the user profile with programming rights.
Recommendations
For versions prior to 13.1RC1, consider the following workarounds:
- The Reset password feature can be entirely disabled by deleting the XWiki/ResetPassword page.
- The script in XWiki/ResetPassword can also be modified or removed: an administrator can replace it with a simple email contact to ask an administrator to reset the password.
قابلية الاستغلال
استغلال
إصلاح
التأثيرات
الباحثون
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾