CoreCVE
Back

MEDIUM

PreviewAction in XWiki 0.9.543 through 0.9.1252 does not set the Author field to the identity of the user who last modified a document, which allows remote authenticated users without programming rights to execute arbitrary code by selecting a document whose author has programming rights, modifying this document to contain a script, and previewing without saving the document

Published Sep 14, 2007

Description

PreviewAction in XWiki 0.9.543 through 0.9.1252 does not set the Author field to the identity of the user who last modified a document, which allows remote authenticated users without programming rights to execute arbitrary code by selecting a document whose author has programming rights, modifying this document to contain a script, and previewing without saving the document.

Affected products

Remediation

No remediation recorded yet.

Metrics

Weaknesses (1)

CWE-264

References (5)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Sep 14, 2007
Updated Sep 16, 2024
Reserved Sep 13, 2007
Link CVE-2006-7223
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 16, 2026
Link CVE-2006-7223
Red Hat
Severity n/a
Public date n/a
Links CVE-2006-7223
GHSA-H5JM-JJGX-Q2WF