CVE-2020-15252: RCE in XWiki
Summary
CVE-2020-15252: RCE in XWiki. Affects org.xwiki.platform:xwiki-platform-oldcore across 2 version ranges.
< 11.10.6
>= 12.0, < 12.5
Fixed in 11.10.6 or 12.5, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
XWiki is an open-source platform for developing collaborative applications. It provides a wiki-like environment for creating and sharing content. The XWiki platform is written in Java and is widely used for building enterprise-level applications. The vulnerability identified as CVE-2020-15252 affects the XWiki platform, specifically the 'xwiki-platform-oldcore' package.
Vulnerability Detail
The vulnerability allows any user with the SCRIPT right (or EDIT right before XWiki 7.4) to gain access to the application server Servlet context. This context contains tools that enable the instantiation of arbitrary Java objects and the invocation of methods, potentially leading to arbitrary code execution. This vulnerability poses a high risk as it allows unauthorized users to execute arbitrary code on the server, compromising the confidentiality, integrity, and availability of the application and its underlying system.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 11.10.611.10.6 -
>= 12.0, < 12.512.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating the package is not immediately feasible, a workaround is to restrict the SCRIPT right to trusted users only. By limiting the access to the vulnerable functionality, the risk of exploitation can be reduced. However, this workaround should be considered temporary, and it is strongly advised to apply the official patch as soon as possible.
Conclusion
The vulnerability CVE-2020-15252 in the 'xwiki-platform-oldcore' package of XWiki allows unauthorized users to execute arbitrary code on the server. It is crucial to update the package to the fixed versions or restrict the SCRIPT right to trusted users. Failure to address this vulnerability can lead to severe consequences, including a complete compromise of the application and its underlying system. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.xwiki.platform:xwiki-platform-oldcore →
FAQ
The vulnerability allows unauthorized users to execute arbitrary code on the server, potentially leading to a complete compromise of the application and its underlying system.
Any application that utilizes the vulnerable 'xwiki-platform-oldcore' package and grants the SCRIPT right to users is affected by this vulnerability.
At the time of this advisory, there are no known public exploits for this vulnerability. However, it is crucial to apply the patch or workaround to prevent potential exploitation.
Yes, this vulnerability can be exploited remotely by any user with the SCRIPT right, without requiring any authentication.
The only alternative solution is to restrict the SCRIPT right to trusted users. However, this should be considered a temporary measure, and applying the official patch is strongly recommended.
Related vulnerabilities
Recent vulnerabilities recorded for org.xwiki.platform:xwiki-platform-oldcore.
