-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.xwiki.rendering:xwiki-rendering-transformation-macro | maven | >= 4.2-milestone-1, < 13.10.11 | 13.10.11 |
| org.xwiki.rendering:xwiki-rendering-transformation-macro | maven | >= 14.0, < 14.4.7 | 14.4.7 |
| org.xwiki.rendering:xwiki-rendering-transformation-macro | maven | >= 14.5, < 14.10 | 14.10 |
JavaJavaMiggo AIRoot Cause AnalysisThe analysis of the provided patch commit c73fa3ccd4ac59057e48e5d4325f659e78e8f86d clearly indicates that the vulnerability is located in the DefaultMacroContentParser.java file. The core of the issue is within the createXDOM method. The vulnerability description states that the 'restricted' attribute of the transformation context was not preserved when processing nested macros. The patch confirms this by modifying the instantiation of TransformationContext. The original, vulnerable code (TransformationContext txContext = new TransformationContext(result, syntax);) created a new context that would not be restricted by default. The patch introduces logic to check the parent context's restricted status and pass it to the new context (new TransformationContext(result, syntax, isRestricted)). This change directly addresses the described vulnerability. Therefore, the createXDOM function is the vulnerable function, as it was responsible for creating the insecure nested execution context that could lead to Remote Code Execution (RCE).
Ongoing coverage of React2Shell