CVE-2021-29459: XSS Cross Site Scripting in XWiki
Summary
CVE-2021-29459: XSS Cross Site Scripting. Affects org.xwiki.platform:xwiki-platform-oldcore across 2 version ranges.
< 12.6.3
>= 12.6.4, < 12.8
Fixed in 12.6.3 or 12.8, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
XWiki is an open-source platform for developing collaborative applications. It provides a wiki-based environment for creating and sharing content. The XWiki platform is built using the Maven ecosystem and includes the 'org.xwiki.platform:xwiki-platform-oldcore' and 'org.xwiki.platform:xwiki-platform-web' packages. These packages are responsible for the core functionality and web interface of XWiki, respectively.
Vulnerability Detail
The vulnerability identified as CVE-2021-29459 is an XSS (Cross-Site Scripting) vulnerability in XWiki. It allows an attacker to persistently inject scripts into XWiki, leading to potential session hijacking, disclosure of sensitive data, CSRF attacks, and other security vulnerabilities. Unregistered users can exploit this vulnerability by filling simple text fields, while registered users can do so by filling their personal information or static lists using App Within Minutes. If the victim has administrative rights, the attacker may even execute code on the server. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.6.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 12.6.312.6.3 -
>= 12.6.4, < 12.812.8
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no easy workaround for this vulnerability other than upgrading XWiki. Applying the patches provided in the recommended versions is the most effective solution to mitigate the risk of XSS attacks.
Conclusion
The XSS Cross Site Scripting vulnerability in XWiki (CVE-2021-29459) poses a significant security risk, allowing attackers to inject scripts and potentially compromise user sessions and sensitive data. It is crucial to upgrade XWiki to the recommended versions (12.8 or 12.6.3) to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for org.xwiki.platform:xwiki-platform-oldcore →
FAQ
The vulnerability allows an attacker to inject scripts into XWiki, potentially leading to session hijacking, disclosure of sensitive data, CSRF attacks, and other security vulnerabilities. It may also result in the takeover of user accounts and, in severe cases, code execution on the server.
Users of XWiki versions prior to 12.8 and 12.6.3 are affected by this vulnerability. Both unregistered and registered users are at risk, with registered users having additional attack vectors.
There are no known workarounds for this vulnerability other than upgrading XWiki to the recommended versions.
You can use Vulert's playground (https://vulert.com/scanner) to check if your XWiki installation is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities using pom.xml without requiring access to the code or installation.
You can find more information about this vulnerability in the XWiki Jira issue: https://jira.xwiki.org/browse/XWIKI-17374
References
Related vulnerabilities
Recent vulnerabilities recorded for org.xwiki.platform:xwiki-platform-oldcore.
