CVE-2021-21380

moderate-risk

Published 2021-03-23

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions of XWiki Platform (and only those with the Ratings API installed), the Rating Script Service expose an API to perform SQL requests without escaping the from and where search arguments. This might lead to an SQL script injection quite easily for any user having Script rights on XWiki. The problem has been patched in XWiki 12.9RC1. The only workaround besides upgrading XWiki would be to uninstall the Ratings API in XWiki from the Extension Manager.

Do I need to act?

3.3% chance of exploitation in next 30 days

EPSS score — moderate exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 7.7/10 High

NETWORK / LOW complexity

Affected Products (4)

Xwiki

Affected Vendors

Xwiki

References (4)

Third Party Advisory https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-79rg-7mv3-jrr5

Issue Tracking https://jira.xwiki.org/browse/XWIKI-17662

Third Party Advisory https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-79rg-7mv3-jrr5

Issue Tracking https://jira.xwiki.org/browse/XWIKI-17662

/ 100

moderate-risk

Severity 27/34 · High

Exploitability 7/34 · Low

Exposure 10/34 · Low