← Zuruck zu CVEs

CVE-2021-43841

MEDIUM

5.4

Beschreibung

XWiki is a generic wiki platform offering runtime services for applications built on top of it. When using default XWiki configuration, it's possible for an attacker to upload an SVG containing a script executed when executing the download action on the file. This problem has been patched so that the default configuration doesn't allow to display the SVG files in the browser. Users are advised to update or to disallow uploads of SVG files.

CVE Details

CVSS v3.1 Bewertung5.4

SchweregradMEDIUM

CVSS VektorCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

AngriffsvektorNETWORK

KomplexitatLOW

Erforderliche PrivilegienLOW

BenutzerinteraktionREQUIRED

Veroffentlicht2/4/2022

Zuletzt geandert11/21/2024

Quellenvd

Honeypot-Sichtungen0

Betroffene Produkte

xwiki:xwiki

Schwachen (CWE)

CWE-79CWE-79

Referenzen

https://github.com/xwiki/xwiki-platform/commit/5853d492b3a274db0d94d560e2a5ea988a271c62(security-advisories@github.com)

https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-9jq9-c2cv-pcrj(security-advisories@github.com)

https://jira.xwiki.org/browse/XWIKI-18368(security-advisories@github.com)

https://www.xwiki.org/xwiki/bin/view/Documentation/AdminGuide/Attachments#HAttachmentdisplayordownload(security-advisories@github.com)

https://github.com/xwiki/xwiki-platform/commit/5853d492b3a274db0d94d560e2a5ea988a271c62(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-9jq9-c2cv-pcrj(af854a3a-2127-422b-91ae-364da2661108)

https://jira.xwiki.org/browse/XWIKI-18368(af854a3a-2127-422b-91ae-364da2661108)

https://www.xwiki.org/xwiki/bin/view/Documentation/AdminGuide/Attachments#HAttachmentdisplayordownload(af854a3a-2127-422b-91ae-364da2661108)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.