-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.xwiki.platform:xwiki-platform-rendering-macro-context | maven | >= 3.0-milestone-1, < 13.10.10 | 13.10.10 |
| org.xwiki.platform:xwiki-platform-rendering-macro-context | maven | >= 14.0-rc-1, < 14.4.5 | 14.4.5 |
| org.xwiki.platform:xwiki-platform-rendering-macro-context | maven | >= 14.5, < 14.8-rc-1 | 14.8-rc-1 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper authorization checks during async script execution. The commit diff shows the patch added 'configuration.setAsyncAllowed(false)' and 'configuration.setCacheAllowed(false)' in ContextMacro.java. Before this fix, the async rendering framework could execute scripts using the target document's author's permissions instead of the current user's. The execute() method in ContextMacro.java is directly responsible for setting up the rendering context, making it the focal point of the authorization flaw. The absence of these restrictions allowed the context macro to bypass proper user rights validation.
JavaJavaOngoing coverage of React2Shell