CVE-2006-7223

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in maven/org.xwiki.platform/xwiki-platform-oldcore

Identifiers

GHSA-h5jm-jjgx-q2wf, CVE-2006-7223

Package Slug

maven/org.xwiki.platform/xwiki-platform-oldcore

Vulnerability

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Description

PreviewAction in XWiki 0.9.543 through 0.9.1252 does not set the Author field to the identity of the user who last modified a document, which allows remote authenticated users without programming rights to execute arbitrary code by selecting a document whose author has programming rights, modifying this document to contain a script, and previewing without saving the document.

Affected Versions

All versions starting from 0.9.543 up to 0.9.1252

Solution

Upgrade to version 1.0B1 or above.

Last Modified

2024-02-13

source