Threats tagged 'ghsa-c32m-27pj-4xcj'

XWiki platform versions starting from 15.9-rc-1 up to but excluding 16.4.7, 16.5.0-rc-1 up to but excluding 16.10.3, and 17.0.0-rc-1 up to but excluding 17.0.0 contain incomplete required rights analyzers for macros. This flaw allows attackers to hide malicious script macros by exploiting unconsidered parameter cases, potentially leading to remote code execution when a user with programming rights edits the page. The issue is fixed in versions 16.4.7, 16.10.3, and 17.0.0. No known workarounds exist other than caution when editing content from untrusted users.