-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.xwiki.platform:xwiki-platform-scheduler-ui | maven | >= 2.0.1, < 14.10.3 | 14.10.3 |
JavaJavaMiggo AIRoot Cause AnalysisThe vulnerability stems from improper handling of user-controlled input in the SchedulerJobSheet's job script rendering. The attack vector shows that user-provided content containing {{groovy}} macros gets executed when viewing the job sheet. The patch (XWIKI-20462) introduced a 'source' parameter to the code macro to validate content origin, indicating the vulnerable code was directly rendering untrusted macro content without this safeguard. The SchedulerJobSheet template would have contained the vulnerable code macro usage that allowed arbitrary script execution with scheduler application rights.
KEV Misses 88% of Exploited CVEs- Get the report