Detections
Analytics

SCA: security update for org.xwiki.platform:xwiki-platform-rendering-wikimacro-store (GHSA-v662-xpcc-9xf6)

medium Tenable Cloud Security Plugin ID 419112

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it.
 In affected versions of XWiki Platform, the `{{wikimacrocontent}}` executes the content with the rights of
 the wiki macro author instead of the caller of that wiki macro. This makes possible to inject scripts
 through it and they will be executed with the rights of the wiki macro (very often a user which has
 Programming rights). Fortunately, no such macro exists by default in XWiki Standard but one could have
 been created or installed with an extension. This vulnerability has been patched in versions XWiki 12.6.3,
 11.10.11 and 12.8-rc-1. There is no easy workaround other than disabling the affected macros. Inserting
 content in a safe way or knowing what is the user who called the wiki macro is not easy. (CVE-2021-21379)

See Also

https://github.com/advisories/GHSA-v662-xpcc-9xf6

Plugin Details

Severity: Medium

ID: 419112

Version: Revision 1.4

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 2.3

Percentile: 8.67

Vendor

Vendor Severity: Low

CVSS v2

Risk Factor: Low

Base Score: 3.5

Temporal Score: 2.6

Vector: CVSS2#AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS Score Source: CVE-2021-21379

CVSS v3

Risk Factor: Medium

Base Score: 5.4

Temporal Score: 4.7

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 3/23/2021

Vulnerability Publication Date: 3/12/2021

Reference Information

CVE: CVE-2021-21379

cwe: CWE-281