PT-2021-14462

CVE-2021-21380

Published

2021-03-23

Updated

2021-03-24

Description by

CVSS 3.1

8.8

High

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions XWiki Platform versions prior to 12.9RC1

Description The XWiki Platform, specifically with the Ratings API installed, exposes an API that allows performing SQL requests without properly escaping the from and where search arguments. This could lead to SQL script injection for users with Script rights on XWiki.

Recommendations For versions prior to 12.9RC1, upgrade to XWiki 12.9RC1 to resolve the issue. As a temporary workaround, consider uninstalling the Ratings API in XWiki from the Extension Manager until a patch is applied.

Exploitability

Exploit

Fix

Impacts

Researchers

Simon Urli

Vendors

Affected products

Weakness enumeration

CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\'SQL Injection\')

Related identifiers

CVE-2021-21380