Get a Demo

Let's Patch It!

Book a short call with one our specialists, we'll walk you through how Endor Patches work, and ask you a few questions about your environment (like your primary programming languages and repository management). We'll also send you an email right after you fill out the form, feel free to reply with any questions you have in advance!

CVE

CVE-2022-24897

Arbitrary filesystem write access from Velocity
Back to all
CVE

CVE-2022-24897

Arbitrary filesystem write access from Velocity

APIs to evaluate content with Velocity is a package for APIs to evaluate content with Velocity. Starting with version 2.3 and prior to 12.6.7, 12.10.3, and 13.0, the velocity scripts are not properly sandboxed against using the Java File API to perform read or write operations on the filesystem. Writing an attacking script in Velocity requires the Script rights in XWiki so not all users can use it, and it also requires finding an XWiki API which returns a File. The problem has been patched in versions 12.6.7, 12.10.3, and 13.0. There is no easy workaround for fixing this vulnerability other than upgrading and being careful when giving Script rights.

Package Versions Affected

Package Version
patch Availability
No items found.

Automatically patch vulnerabilities without upgrading

Fix Without Upgrading
Detect compatible fix
Apply safe remediation
Fix with a single pull request

CVSS Version

Severity
Base Score
CVSS Version
Score Vector
C
H
U
7.5
-
3.1
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
C
H
U
0
-
3.1
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
C
H
U
-

Related Resources

No items found.

References

https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24897.json, https://github.com/xwiki/xwiki-commons/commit/215951cfb0f808d0bf5b1097c9e7d1e503449ab8, https://github.com/xwiki/xwiki-commons/pull/127, https://github.com/xwiki/xwiki-commons/security/advisories/GHSA-cvx5-m8vg-vxgc, https://jira.xwiki.org/browse/XWIKI-5168, https://nvd.nist.gov/vuln/detail/CVE-2022-24897

Severity

7.5

CVSS Score
0
10

Basic Information

Ecosystem
Base CVSS
7.5
EPSS Probability
0.00408%
EPSS Percentile
0.60596%
Introduced Version
0,1bf0361e80e94dd763901e3a863b4caaa24b6e17
Fix Available
215951cfb0f808d0bf5b1097c9e7d1e503449ab8,82cca0679aa3d0e04a0f64e74d30f4ba79e0d416

Fix Critical Vulnerabilities Instantly

Secure your app without upgrading.
Fix Without Upgrading