-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stemmed from improper access control in the space admin rights assignment logic. The unpatched code in LiveTableEditSheet.xml granted admin rights (via WebPreferences modification) when creating a new space, without checking if the user had the 'script' right. The commit diff shows the critical addition of a script right check (hasAccess('script')) before granting admin rights. This confirms the original code lacked this security check, making the space admin rights assignment function the root cause. The XSS (CWE-79) occurs as a consequence of the escalated script privileges.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.xwiki.platform:xwiki-platform-appwithinminutes | maven | >= 4.0-milestone-2, < 4.2-milestone-1 | 4.2-milestone-1 |
| org.xwiki.platform:xwiki-platform-appwithinminutes-ui | maven | >= 4.2-milestone-1, < 13.10.11 | 13.10.11 |
| org.xwiki.platform:xwiki-platform-appwithinminutes-ui | maven | >= 14.0-rc-1, < 14.4.8 | 14.4.8 |
| org.xwiki.platform:xwiki-platform-appwithinminutes-ui | maven | >= 14.5, < 14.10.1 | 14.10.1 |
Ongoing coverage of React2Shell