Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.5

Authenticated users can execute code on XWiki documents

CVE-2006-7223 · published 19 years ago
Summary

A security weakness in XWiki allows authenticated users to execute code on documents with programming rights, which could lead to unauthorized actions. To protect your XWiki instance, ensure that only authorized users have programming rights and keep your XWiki software up to date with the latest version.

What to do
  • Update xwiki org.xwiki.platform:xwiki-platform-oldcore to version 1.0B1.
Affected software
Ecosystem VendorProductAffected versions
maven xwiki org.xwiki.platform:xwiki-platform-oldcore >= 0.9.543, <= 0.9.1252
Fix: upgrade to 1.0B1
– xwiki xwiki 0.9.543
0.9.790
0.9.793
0.9.840
0.9.1252
cpe:2.3:a:xwiki:xwiki:0.9.543:*:*:*:*:*:*:*
Original advisory text
PreviewAction in XWiki 0.9.543 through 0.9.1252 does not set the Author field to the identity of the user who last modified a document, which allows remote authenticated users without programming r...
PreviewAction in XWiki 0.9.543 through 0.9.1252 does not set the Author field to the identity of the user who last modified a document, which allows remote authenticated users without programming rights to execute arbitrary code by selecting a document whose author has programming rights, modifying this document to contain a script, and previewing without saving the document.
References
Severity
6.5 Medium
Exploitation
2% chance of attack within 30 days
Type
CWE-264Permissions, Privileges, and Access Controls
Timeline
Published14 Sep 2007
Updated31 Oct 2026
First seen6 Mar 2026
Sources
GHSA-h5jm-jjgx-q2wf · GHSA
CVE-2006-7223 · NVD
Track software like this
Free during beta