{"id":"GHSA-h353-hc43-95vc","summary":"Script injection without script or programming rights through Gadget titles","details":"### Impact\nA user without Script or Programming right is able to execute script requiring privileges by editing gadget titles in the dashboard.\n\n### Patches\nThe issue has been patched in XWiki 12.6.7, 12.10.3 and 13.0RC1.\n\n### Workarounds\nThere's no easy workaround for this issue, it is recommended to upgrade XWiki.\n\n### References\nhttps://jira.xwiki.org/browse/XWIKI-17794\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [JIRA](https://jira.xwiki.org)\n* Email us at [XWiki security mailing-list](mailto:security@xwiki.org)\n","aliases":["CVE-2021-32621"],"modified":"2026-07-08T06:29:19.967327426Z","published":"2021-05-18T18:36:16Z","database_specific":{"github_reviewed_at":"2021-05-18T16:46:49Z","nvd_published_at":"2021-05-28T21:15:00Z","cwe_ids":["CWE-94"],"severity":"HIGH","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-h353-hc43-95vc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-32621"},{"type":"WEB","url":"https://github.com/xwiki/xwiki-platform/commit/bb7068bd911f91e5511f3cfb03276c7ac81100bc"},{"type":"PACKAGE","url":"https://github.com/xwiki/xwiki-platform"},{"type":"WEB","url":"https://jay-from-future.github.io/cve/2021/06/17/xwiki-rce-cve.html"},{"type":"WEB","url":"https://jira.xwiki.org/browse/XWIKI-17794"}],"affected":[{"package":{"name":"org.xwiki.commons:xwiki-commons-core","ecosystem":"Maven","purl":"pkg:maven/org.xwiki.commons/xwiki-commons-core"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.6.7"}]}],"versions":["10.0","10.1","10.1-rc-1","10.10","10.10-rc-1","10.11","10.11-rc-1","10.11.1","10.11.10","10.11.11","10.11.2","10.11.3","10.11.4","10.11.5","10.11.6","10.11.7","10.11.8","10.11.9","10.2","10.3","10.4","10.4-rc-1","10.5","10.5-rc-1","10.6","10.6-rc-1","10.6.1","10.7","10.7-rc-1","10.7.1","10.8","10.8-rc-1","10.8.1","10.8.2","10.8.3","10.9","11.0","11.0.1","11.0.2","11.0.3","11.1","11.1-rc-1","11.10","11.10.1","11.10.10","11.10.11","11.10.12","11.10.13","11.10.2","11.10.3","11.10.4","11.10.5","11.10.6","11.10.7","11.10.8","11.2","11.2-rc-1","11.3","11.3-rc-1","11.3.1","11.3.2","11.3.3","11.3.4","11.3.5","11.3.6","11.3.7","11.4","11.4-rc-1","11.5","11.5-rc-1","11.6","11.6-rc-1","11.6.1","11.7","11.7-rc-1","11.8","11.8-rc-1","11.8.1","11.9","12.0","12.0-rc-1","12.1","12.1-rc-1","12.2","12.2.1","12.3","12.3-rc-1","12.4","12.4-rc-1","12.5","12.5-rc-1","12.5.1","12.6","12.6.1","12.6.2","12.6.3","12.6.4","12.6.5","12.6.6","3.2","3.2-milestone-3","3.2-rc-1","3.2.1","3.3","3.3-milestone-1","3.3-milestone-2","3.3-rc-1","3.3.1","3.4","3.4-milestone-1","3.4-rc-1","3.5","3.5-milestone-1","3.5.1","4.0","4.0-milestone-1","4.0-milestone-2","4.0-rc-1","4.0.1","4.1","4.1-milestone-1","4.1-milestone-2","4.1-rc-1","4.1.1","4.1.2","4.1.3","4.1.4","4.2","4.2-milestone-1","4.2-milestone-2","4.2-milestone-3","4.2-rc-1","4.3","4.3-milestone-1","4.3-milestone-2","4.3-rc-1","4.3.1","4.4","4.4-rc-1","4.4.1","4.5","4.5-milestone-1","4.5-rc-1","4.5.1","4.5.2","4.5.3","5.0","5.0-milestone-1","5.0-milestone-2","5.0-rc-1","5.0.1","5.0.2","5.0.3","5.1","5.1-milestone-1","5.1-milestone-2","5.1-rc-1","5.2","5.2-milestone-1","5.2-milestone-2","5.2-rc-1","5.2.1","5.2.2","5.2.3","5.2.4","5.3","5.3-milestone-1","5.3-milestone-2","5.3-rc-1","5.4","5.4-milestone-1","5.4-rc-1","5.4.1","5.4.2","5.4.3","5.4.4","5.4.5","5.4.6","5.4.7","6.0","6.0-milestone-1","6.0-milestone-2","6.0-rc-1","6.0.1","6.1","6.1-milestone-1","6.1-milestone-2","6.1-rc-1","6.2","6.2-milestone-1","6.2-milestone-2","6.2-rc-1","6.2.1","6.2.2","6.2.3","6.2.4","6.2.5","6.2.6","6.2.7","6.3","6.3-milestone-1","6.3-milestone-2","6.3-rc-1","6.4","6.4-milestone-1","6.4-milestone-2","6.4-milestone-3","6.4-rc-1","6.4.1","6.4.2","6.4.3","6.4.4","6.4.5","6.4.6","6.4.7","6.4.8","7.0","7.0-milestone-1","7.0-milestone-2","7.0-rc-1","7.0.1","7.1","7.1-milestone-1","7.1-milestone-2","7.1-rc-1","7.1.1","7.1.2","7.1.3","7.1.4","7.2","7.2-milestone-1","7.2-milestone-2","7.2-milestone-3","7.2-rc-1","7.3","7.3-milestone-1","7.3-rc-1","7.4","7.4-milestone-1","7.4-milestone-2","7.4-rc-1","7.4.1","7.4.2","7.4.3","7.4.4","7.4.5","7.4.6","8.0","8.0-milestone-1","8.0-milestone-2","8.0-rc-1","8.1","8.1-milestone-1","8.1-milestone-2","8.1-rc-1","8.2","8.2-milestone-1","8.2-milestone-2","8.2-rc-1","8.2.1","8.2.2","8.3","8.3-milestone-2","8.3-rc-1","8.4","8.4-rc-1","8.4.1","8.4.2","8.4.3","8.4.4","8.4.5","8.4.6","9.0","9.0-rc-1","9.1","9.1-rc-1","9.1.1","9.1.2","9.10","9.10-rc-1","9.10.1","9.11","9.11-rc-1","9.11.1","9.11.2","9.11.3","9.11.4","9.11.5","9.11.6","9.11.7","9.11.8","9.11.9","9.2","9.2-rc-1","9.3","9.3-rc-1","9.3.1","9.4","9.4-rc-1","9.5","9.5-rc-1","9.5.1","9.6","9.6-rc-1","9.7","9.7-rc-1","9.8","9.8-rc-1","9.8.1","9.9","9.9-rc-1","9.9-rc-2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/05/GHSA-h353-hc43-95vc/GHSA-h353-hc43-95vc.json"}},{"package":{"name":"org.xwiki.commons:xwiki-commons-core","ecosystem":"Maven","purl":"pkg:maven/org.xwiki.commons/xwiki-commons-core"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.10.0"},{"fixed":"12.10.3"}]}],"versions":["12.10","12.10.1","12.10.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/05/GHSA-h353-hc43-95vc/GHSA-h353-hc43-95vc.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}