CVE-2006-7223
Last modified
CVE-2006-7223 is a vulnerability of currently unknown severity. PreviewAction in XWiki 0.9.543 through 0.9.1252 does not set the Author field to the identity of the user who last modified a document, which allows remote authenticated users without programming rights to execute arbitrary code by selecting a document whose author has programming rights, modifying this document to contain a script, and previewing without saving the document.. EPSS estimates a 1.51% chance of exploitation in the next 30 days.
Description
PreviewAction in XWiki 0.9.543 through 0.9.1252 does not set the Author field to the identity of the user who last modified a document, which allows remote authenticated users without programming rights to execute arbitrary code by selecting a document whose author has programming rights, modifying this document to contain a script, and previewing without saving the document.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Xwiki | Xwiki | 0.9.543 |
| Xwiki | Xwiki | 0.9.790 |
| Xwiki | Xwiki | 0.9.793 |
| Xwiki | Xwiki | 0.9.840 |
| Xwiki | Xwiki | 0.9.1252 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2006-7223?
How severe is CVE-2006-7223?
How do I fix CVE-2006-7223?
Are you affected by CVE-2006-7223?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST