-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.xwiki.platform:xwiki-platform-office-viewer | maven | >= 2.5-milestone-2, < 13.10.11 | 13.10.11 |
| org.xwiki.platform:xwiki-platform-office-viewer | maven | >= 14.0-rc-1, < 14.4.8 | 14.4.8 |
| org.xwiki.platform:xwiki-platform-office-viewer | maven | >= 14.5, < 14.10.1 | 14.10.1 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the Office document viewer macro's handling of document references. The Jira tickets (XWIKI-20447, XWIKI-20324) demonstrate that unauthenticated users could inject 'file://' URLs or internal URLs via the 'reference' parameter. The OfficeViewerMacro's execute method is responsible for processing these references, and prior to patching, it lacked proper validation to restrict URL schemes and internal network access. The high confidence comes from direct correlation between the vulnerability description, attack vectors demonstrated in Jira tickets, and the macro's role in processing untrusted URLs.