← Voltar para CVEs

CVE-2021-43841

MEDIUM

5.4

Descricao

XWiki is a generic wiki platform offering runtime services for applications built on top of it. When using default XWiki configuration, it's possible for an attacker to upload an SVG containing a script executed when executing the download action on the file. This problem has been patched so that the default configuration doesn't allow to display the SVG files in the browser. Users are advised to update or to disallow uploads of SVG files.

Detalhes CVE

Pontuacao CVSS v3.15.4

SeveridadeMEDIUM

Vetor CVSSCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Vetor de ataqueNETWORK

ComplexidadeLOW

Privilegios necessariosLOW

Interacao do usuarioREQUIRED

Publicado2/4/2022

Ultima modificacao11/21/2024

Fontenvd

Avistamentos honeypot0

Produtos afetados

xwiki:xwiki

Fraquezas (CWE)

CWE-79CWE-79

Referencias

https://github.com/xwiki/xwiki-platform/commit/5853d492b3a274db0d94d560e2a5ea988a271c62(security-advisories@github.com)

https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-9jq9-c2cv-pcrj(security-advisories@github.com)

https://jira.xwiki.org/browse/XWIKI-18368(security-advisories@github.com)

https://www.xwiki.org/xwiki/bin/view/Documentation/AdminGuide/Attachments#HAttachmentdisplayordownload(security-advisories@github.com)

https://github.com/xwiki/xwiki-platform/commit/5853d492b3a274db0d94d560e2a5ea988a271c62(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-9jq9-c2cv-pcrj(af854a3a-2127-422b-91ae-364da2661108)

https://jira.xwiki.org/browse/XWIKI-18368(af854a3a-2127-422b-91ae-364da2661108)

https://www.xwiki.org/xwiki/bin/view/Documentation/AdminGuide/Attachments#HAttachmentdisplayordownload(af854a3a-2127-422b-91ae-364da2661108)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.