CVE-2021-32621: Script Injection Vulnerability in org.xwiki.commons:xwiki-commons-core
Summary
CVE-2021-32621: Script injection without script or programming rights through Gadget titles. Affects org.xwiki.commons:xwiki-commons-core across 2 version ranges.
< 12.6.7
>= 12.10.0, < 12.10.3
Fixed in 12.6.7 or 12.10.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
org.xwiki.commons:xwiki-commons-core is a Maven package that provides core functionality for the XWiki platform. XWiki is an open-source wiki software that allows users to create and collaborate on content. The package is responsible for handling various operations and features within the XWiki platform.
Vulnerability Detail
The vulnerability (CVE-2021-32621) allows a user without Script or Programming rights to execute scripts that require privileges by editing gadget titles in the XWiki dashboard. This means that an unauthorized user can inject malicious scripts into gadget titles, potentially leading to unauthorized access, data manipulation, or other malicious activities. The vulnerability has a CVSS score of 8.8, indicating a high severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 12.6.712.6.7 -
>= 12.10.0, < 12.10.312.10.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no easy workaround for this vulnerability. The best course of action is to upgrade XWiki to the patched versions mentioned above.
Conclusion
The script injection vulnerability in org.xwiki.commons:xwiki-commons-core can allow unauthorized users to execute privileged scripts by manipulating gadget titles. To mitigate this vulnerability, it is crucial to upgrade XWiki to the patched versions. Upgrading will ensure that the vulnerability is addressed and protect the XWiki installation from potential script injection attacks. For further support and assistance, you can contact XWiki through their JIRA or security mailing-list.
See every vulnerability recorded for org.xwiki.commons:xwiki-commons-core →
FAQ
The vulnerability allows unauthorized users to execute scripts requiring privileges, potentially leading to unauthorized access, data manipulation, or other malicious activities.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your XWiki installation is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it in real-time to identify any open-source vulnerabilities, including CVE-2021-32621.
Unfortunately, there are no known workarounds for this vulnerability. Upgrading to the patched versions of XWiki is the recommended solution.
You can find more information about this vulnerability in the XWiki JIRA issue XWIKI-17794 (https://jira.xwiki.org/browse/XWIKI-17794).
If you have any questions or need further assistance regarding this vulnerability, you can open an issue in the XWiki JIRA or email the XWiki security mailing-list at security@xwiki.org.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.xwiki.commons:xwiki-commons-core.
