// For flags

CVE-2021-21379

It's possible to execute anything with the rights of the author of a macro which uses the {{wikimacrocontent}} macro

Severity Score

5.4
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions of XWiki Platform, the `{{wikimacrocontent}}` executes the content with the rights of the wiki macro author instead of the caller of that wiki macro. This makes possible to inject scripts through it and they will be executed with the rights of the wiki macro (very often a user which has Programming rights). Fortunately, no such macro exists by default in XWiki Standard but one could have been created or installed with an extension. This vulnerability has been patched in versions XWiki 12.6.3, 11.10.11 and 12.8-rc-1. There is no easy workaround other than disabling the affected macros. Inserting content in a safe way or knowing what is the user who called the wiki macro is not easy.

XWiki Platform es una plataforma wiki genérica que ofrece servicios de tiempo de ejecución para aplicaciones creadas sobre ella. En las versiones afectadas de la plataforma XWiki, el "{{wikimacrocontent}}" ejecuta el contenido con los derechos de autor de la macro wiki en lugar del autor de la llamada de esa macro wiki. Esto hace posible inyectar scripts por medio de él y se ejecutarán con los derechos de la macro wiki (muy a menudo un usuario que presenta derechos de programación). Afortunadamente, tal macro no se presenta por defecto en XWiki Standard, pero podría haber sido creada o instalada con una extensión. Esta vulnerabilidad ha sido parcheada en versiones XWiki 12.6.3, 11.10.11 y 12.8-rc-1. No existe una solución alternativa sencilla que no sea la de deshabilitar las macros afectadas. Insertar contenido de manera segura o saber cuál es el usuario que llamó a la macro wiki no es fácil

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
Required
Scope
Changed
Confidentiality
High
Integrity
High
Availability
None
Attack Vector
Network
Attack Complexity
Medium
Authentication
Single
Confidentiality
None
Integrity
Partial
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2020-12-22 CVE Reserved
  • 2021-03-12 CVE Published
  • 2023-03-08 EPSS Updated
  • 2024-08-03 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-281: Improper Preservation of Permissions
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Xwiki
Search vendor "Xwiki"
 Xwiki
Search vendor "Xwiki" for product "Xwiki"
 >= 11.4 < 11.10.11
Search vendor "Xwiki" for product "Xwiki" and version " >= 11.4 < 11.10.11"
-
Affected
Xwiki
Search vendor "Xwiki"
 Xwiki
Search vendor "Xwiki" for product "Xwiki"
 >= 12.0 < 12.6.3
Search vendor "Xwiki" for product "Xwiki" and version " >= 12.0 < 12.6.3"
-
Affected
Xwiki
Search vendor "Xwiki"
 Xwiki
Search vendor "Xwiki" for product "Xwiki"
 >= 12.7 <= 12.7.1
Search vendor "Xwiki" for product "Xwiki" and version " >= 12.7 <= 12.7.1"
-
Affected