-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper author handling during document edits. The patch adds critical logic in prepareEditedDocument to set contentAuthor and metadataAuthor to the current user when content/metadata is modified. The absence of this logic in vulnerable versions meant edited content retained the original author's privileges. The function's failure to update authorship fields created the privilege escalation vector, as confirmed by the added authorization checks in the commit diff.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.xwiki.platform:xwiki-platform-oldcore | maven | >= 15.0, < 15.2-rc-1 | 15.2-rc-1 |
| org.xwiki.platform:xwiki-platform-oldcore | maven | >= 1.0, < 14.10.6 | 14.10.6 |