-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability description states that the LESS compiler's script API incorrectly checked for rights when calling the cache cleaning API. The provided commit (91752122d8782f171f8728004a57bdaefc34253e) modifies three methods in LessCompilerScriptService.java: clearCache, clearCacheFromColorTheme, and clearCacheFromSkin. In each of these methods, the authorization check authorizationManager.hasAccess(Right.PROGRAM, xcontext.getDoc().getAuthorReference(), xcontext.getDoc().getDocumentReference()) was replaced with authorizationManager.hasAccess(Right.PROGRAM). This change indicates that the previous, more specific authorization check was the source of the vulnerability, allowing cache clearing without the necessary programming rights. The commit message also mentions using the 'contextual authorization manager' which supports this interpretation. Therefore, these three functions, with their original authorization checks, are identified as vulnerable.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.xwiki.platform:xwiki-platform-lesscss-script | maven | >= 6.1-milestone-1, < 15.10.12 | 15.10.12 |
| org.xwiki.platform:xwiki-platform-lesscss-script | maven | >= 16.0.0-rc-1, < 16.4.3 | 16.4.3 |
| org.xwiki.platform:xwiki-platform-lesscss-script | maven | >= 16.5.0-rc-1, < 16.8.0-rc-1 | 16.8.0-rc-1 |
Ongoing coverage of React2Shell