CVE-2020-15171

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2020-15171
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2020-15171.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2020-15171
Aliases
Related
Published
2020-09-10T20:15:11.697Z
Modified
2026-03-17T06:49:14.862851Z
Severity
  • 6.6 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

In XWiki before versions 11.10.5 or 12.2.1, any user with SCRIPT right (EDIT right before XWiki 7.4) can gain access to the application server Servlet context which contains tools allowing to instantiate arbitrary Java objects and invoke methods that may lead to arbitrary code execution. The only workaround is to give SCRIPT right only to trusted users.

References

Affected packages

Git / github.com/xwiki/xwiki-platform

Affected ranges

Type
GIT
Repo
https://github.com/xwiki/xwiki-platform
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
c8b677340f90b174ba44b4a3b57cb8e7801c6cd5
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
340320d9578396e01789b74c913646238fb795c1
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "11.10.5"
        },
        {
            "introduced": "12.0.0"
        },
        {
            "fixed": "12.2.1"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2020-15171.json"