CVE-2021-3137: Cross Site Scripting (XSS) in XWiki
Summary
CVE-2021-3137: Cross Site Scripting (XSS) in XWiki. Affects org.xwiki.commons:xwiki-commons versions < 12.10.3. Fixed in 12.10.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
XWiki is an open-source wiki software platform that allows users to create and collaborate on content. It provides features such as document management, version control, and access control. The XWiki Commons package, specifically version 12.10.2, is affected by a Cross Site Scripting (XSS) vulnerability. This package is commonly used in XWiki deployments and provides various utility classes and functions for the XWiki software.
Vulnerability Detail
The XSS vulnerability in XWiki 12.10.2 is caused by improper handling of SVG documents in the comment section's upload feature. An attacker can exploit this vulnerability by uploading a malicious SVG document that contains embedded scripts. When the SVG document is rendered in the comment section, the embedded scripts are executed in the context of the victim's browser, allowing the attacker to perform arbitrary actions on behalf of the victim. This can lead to various consequences, such as stealing sensitive information, modifying content, or performing unauthorized actions.
How To Fix
Minimum fixed version
12.10.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the comment section or restrict file uploads to non-executable file types. This can help mitigate the risk of exploitation until the package is updated to a secure version. However, it is important to note that workarounds may not provide complete protection and should be considered temporary measures until the vulnerability is fixed.
Conclusion
The XSS vulnerability in XWiki 12.10.2 can be mitigated by upgrading to version 12.10.3 or later of the XWiki Commons package. In the meantime, users can apply temporary workarounds such as disabling the comment section or restricting file uploads. It is important to stay vigilant and keep software dependencies up to date to ensure the security of XWiki installations. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.xwiki.commons:xwiki-commons →
FAQ
This vulnerability allows an attacker to execute arbitrary scripts in the context of a victim's browser, potentially leading to unauthorized actions, data theft, or content modification.
At the time of this advisory, there is no known public exploit for this vulnerability. However, it is advisable to apply the recommended fix or workaround as soon as possible to prevent potential exploitation.
No, only XWiki version 12.10.2 is affected by this specific vulnerability. It is recommended to upgrade to version 12.10.3 or later to mitigate the risk.
Yes, this vulnerability can be exploited remotely. An attacker can upload a malicious SVG document to the comment section, and when it is rendered, the embedded scripts will be executed in the victim's browser.
Yes, a fix is available in XWiki Commons version 12.10.3. It is recommended to update the package to this version or later to address the XSS vulnerability.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
