-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from the async macro's rendering context not properly enforcing 'restricted mode' access controls. The XRENDERING-694 ticket explicitly mentions that the 'rendering.restricted' context entry was not handled by the context store. The DefaultContextStoreManager.getSupportedEntries() method defines which context parameters are preserved during asynchronous execution. The absence of 'restricted' in this list before patching allowed the display macro to execute without proper authorization checks. This matches the CWE-284 (Improper Access Control) aspect of the vulnerability, as the missing context entry led to privilege escalation.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.xwiki.platform:xwiki-platform-oldcore | maven | >= 10.11.1, < 13.10.11 | 13.10.11 |
| org.xwiki.platform:xwiki-platform-oldcore | maven | >= 14.0-rc-1, < 14.4.8 | 14.4.8 |
| org.xwiki.platform:xwiki-platform-oldcore | maven | >= 14.5, < 14.10.3 | 14.10.3 |
| org.xwiki.platform:xwiki-platform-rendering-async-macro | maven | >= 10.11.1, < 13.10.11 | 13.10.11 |
| org.xwiki.platform:xwiki-platform-rendering-async-macro | maven | >= 14.0-rc-1, < 14.4.8 | 14.4.8 |
| org.xwiki.platform:xwiki-platform-rendering-async-macro | maven | >= 14.5, < 14.10.3 | 14.10.3 |