title: Velocity execution without script right through tree macro
description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to execute a Velocity script without script right through the document tree. This has been patched in XWiki 14.10.7 and 15.2RC1.
problem types: CWE-863: Incorrect Authorization
affected:
{
vendor: xwiki
product: xwiki-platform
versions:
version: >= 8.3-rc-1, < 14.10.7, status: affected
version: >= 15.0-rc-1, < 15.2-rc-1, status: affected
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 8.3
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
version: 3.1
]