NVD

Id
65766  
Name
CVE-2006-7223  
Description
PreviewAction in XWiki 0.9.543 through 0.9.1252 does not set the Author field to the identity of the user who last modified a document, which allows remote authenticated users without programming rights to execute arbitrary code by selecting a document whose author has programming rights, modifying this document to contain a script, and previewing without saving the document.  
Reject
 
CVSS Version
2  
CVSS Score
6.5  
Severity
Medium  
CVSS Base Score
6.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
8  
CVSS Vector
(AV:N/AC:L/Au:S/C:P/I:P/A:P)  
Pub Date
2016-12-20  
Published
2007-09-13  
Modified Date
2008-09-05  
Seq
2006-7223  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
342422 65766 CVE-2006-7223 http://jira.xwiki.org/jira/browse/XWIKI-366  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
61441 JVNDB-2006-003707 XWiki の PreviewAction における任意のコードを実行される脆弱性 XWiki の PreviewAction は、ドキュメントを最後に変更したユーザを特定する Author フィールドを設定しないため、任意のコードを実行される脆弱性が存在します。 CVE-2006-7223 23325 CVE-2006-7223 65766 6.5 http://jvndb.jvn.jp/ja/contents/2006/JVNDB-2006-003707.html 2006-10-11 2012-12-20 View