CVE-2021-43841

Description

XWiki is a generic wiki platform offering runtime services for applications built on top of it. When using default XWiki configuration, its possible for an attacker to upload an SVG containing a script executed when executing the download action on the file. This problem has been patched so that the default configuration doesnt allow to display the SVG files in the browser. Users are advised to update or to disallow uploads of SVG files.

Risk Information

Base Score

5.4

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS Score

Exploitation Probability

0.464

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2021-43841 are fixed in XWiki-platform-tool-configuration-resources 13.3	Windows
Vulnerabilities CVE-2021-43841,CVE-2022-23618 are fixed in Xwiki-platform-oldcore 13.3	Windows
Vulnerabilities CVE-2021-43841 are fixed in XWiki-platform-tool-configuration-resources 12.10.6	Windows
Vulnerabilities CVE-2021-43841,CVE-2022-23617 are fixed in Xwiki-platform-oldcore 12.10.6	Windows
Vulnerabilities CVE-2021-43841 are fixed in XWiki-platform-tool-configuration-resources for Linux 13.3	Linux
Vulnerabilities CVE-2021-43841,CVE-2022-23618 are fixed in Xwiki-platform-oldcore for Linux 13.3	Linux
Vulnerabilities CVE-2021-43841 are fixed in XWiki-platform-tool-configuration-resources for Linux 12.10.6	Linux
Vulnerabilities CVE-2021-43841,CVE-2022-23617 are fixed in Xwiki-platform-oldcore for Linux 12.10.6	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234