CVE-2023-50732
Assigner: GitHub_M
Published: 2023-12-21T19:42:01.215Z
State: PUBLISHED
title: Velocity execution without script right through tree macro
problemTypes: descriptions: cweId: CWE-863
description: CWE-863: Incorrect Authorization
type: CWE
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 8.3
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
version: 3.1
affected: vendor: xwiki
product: xwiki-platform
versions: version: >= 8.3-rc-1, < 14.10.7
status: affected
version: >= 15.0-rc-1, < 15.2-rc-1
status: affected
descriptions: value: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to execute a Velocity script without script right through the document tree. This has been patched in XWiki 14.10.7 and 15.2RC1.
source: advisory: GHSA-p5f8-qf24-24cj
discovery: UNKNOWN