CVE-2021-21380 : What You Need to Know

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions of XWiki Platform, the Rating Script Service exposes an API that allows SQL script injection, posing a security risk for users with Script rights on XWiki. The vulnerability has been patched in XWiki 12.9RC1, with the workaround being to uninstall the Ratings API.

Understanding CVE-2021-21380

This section provides insights into the impact and technical details of the CVE.

What is CVE-2021-21380?

CVE-2021-21380 refers to the SQL injection vulnerability in XWiki Platform caused by the Rating Script Service.

The Impact of CVE-2021-21380

The vulnerability allows users with Script rights on XWiki to perform SQL requests without proper escaping, leading to potential SQL script injection.

Technical Details of CVE-2021-21380

Here, we delve into the specifics of the vulnerability.

Vulnerability Description

In affected versions of XWiki Platform with the Ratings API installed, the Rating Script Service exposes an API that enables SQL script injection.

Affected Systems and Versions

XWiki Platform versions prior to 12.9 are impacted by this vulnerability.

Exploitation Mechanism

The vulnerability can be exploited by users with Script rights executing SQL requests without escaping certain search arguments.

Mitigation and Prevention

This section discusses the steps to mitigate and prevent exploitation of CVE-2021-21380.

Immediate Steps to Take

Users are urged to upgrade to XWiki 12.9RC1 or above to patch the vulnerability. Alternatively, uninstalling the Ratings API is recommended.

Long-Term Security Practices

Regularly updating XWiki Platform to the latest versions and monitoring security advisories can help prevent such vulnerabilities.

Patching and Updates

Stay informed about security patches and updates released by XWiki to address known security issues.