CVE-2022-24897

Description

APIs to evaluate content with Velocity is a package for APIs to evaluate content with Velocity. Starting with version 2.3 and prior to 12.6.7, 12.10.3, and 13.0, the velocity scripts are not properly sandboxed against using the Java File API to perform read or write operations on the filesystem. Writing an attacking script in Velocity requires the Script rights in XWiki so not all users can use it, and it also requires finding an XWiki API which returns a File. The problem has been patched in versions 12.6.7, 12.10.3, and 13.0. There is no easy workaround for fixing this vulnerability other than upgrading and being careful when giving Script rights.

Risk Information

Base Score

7.5

MODERATE

Vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score

Exploitation Probability

0.273

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2022-24897 are fixed in XWiki-commons-velocity 12.6.7	Windows
Vulnerabilities CVE-2022-24897 are fixed in XWiki-commons-velocity 12.10.3	Windows
Vulnerabilities CVE-2022-24897 are fixed in XWiki-commons-velocity for Linux 12.6.7	Linux
Vulnerabilities CVE-2022-24897 are fixed in XWiki-commons-velocity for Linux 12.10.3	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234