org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability
概要
org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
XWiki Platform is a generic wiki platform. Starting in versions 6.3-rc-1 and 6.2.4, it's possible to inject arbitrary wiki syntax including Groovy, Python and Velocity script macros via the newThemeName request parameter (URL parameter), in combination with additional parameters. This has been patched in the supported versions 13.10.10, 14.9-rc-1, and 14.4.6. As a workaround, it is possible to edit FlamingoThemesCode.WebHomeSheet and manually perform the changes from the patch fixing the issue.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
影響パッケージ
参照URL
- advisory github.com
- advisory nvd.nist.gov
- advisory github.com
- package github.com
- patch github.com
- web jira.xwiki.org