Description

In XWiki Platform 7.2 through 11.10.2, registered users without scripting/programming permissions are able to execute python/groovy scripts while editing personal dashboards. This has been fixed 11.3.7 , 11.10.3 and 12.0.

Remediation

References

CVE-2020-11057

Related Vulnerabilities

MongoDb Access of Resource Using Incompatible Type ('Type Confusion') Vulnerability (CVE-2026-13066)

WordPress 3.3 Cross-Site Scripting Vulnerability (3.3)

WordPress Plugin Smart Manager for WooCommerce & WpeC Multiple Unspecified Vulnerabilities (3.9.13)

WordPress 4.0.x Multiple Vulnerabilities (4.0 - 4.0.17)

XOOPS Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2017-7944)

Severity

High

Classification

CVE-2020-11057 CWE-94 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities