Published: 23/03/2021 Updated: 24/03/2021

CVSS v2 Base Score: 6.5 | Impact Score: 6.4 | Exploitability Score: 8

CVSS v3 Base Score: 8.8 | Impact Score: 5.9 | Exploitability Score: 2.8

VMScore: 580

Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions of XWiki Platform (and only those with the Ratings API installed), the Rating Script Service expose an API to perform SQL requests without escaping the from and where search arguments. This might lead to an SQL script injection quite easily for any user having Script rights on XWiki. The problem has been patched in XWiki 12.9RC1. The only workaround besides upgrading XWiki would be to uninstall the Ratings API in XWiki from the Extension Manager.

Vulnerable Product	Search on Vulmon	Subscribe to Product
xwiki xwiki 6.4
xwiki xwiki

A CodeQL workshop covering CVE-2021-21380

CodeQL workshop for Java: Finding a SQL injection In this workshop we will use syntactical and semantic reasoning to find a SQL injection in the XWiki platform's rating component documented by CVE-2021-21380 Contents CodeQL workshop for Java: Finding a SQL injection Contents Prerequisites and setup instructions On your local machine Installation Setup steps Worksh

A CodeQL workshop covering CVE-2021-21380

CodeQL workshop for Java: Finding a SQL injection In this workshop we will use syntactical and semantic reasoning to find a SQL injection in the XWiki platform's rating component documented by CVE-2021-21380 Contents CodeQL workshop for Java: Finding a SQL injection Contents Prerequisites and setup instructions On your local machine Installation Setup steps Worksh

CWE-89 https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-79rg-7mv3-jrr5 https://jira.xwiki.org/browse/XWIKI-17662 https://nvd.nist.gov https://github.com/rvermeulen/codeql-workshop-cve-2021-21380

CVE-2021-21380

Vulnerability Summary

Vulnerability Trend

Github Repositories

References

Vulmon Search

About

Products

Connect