¡¾Îó²îͨ¸æ¡¿XWiki Details SummaryºêÔ¶³Ì´úÂëÖ´ÐÐÎó²î(CVE-2025-65036)

Ðû²¼Ê±¼ä 2025-12-08

Ò»¡¢Îó²î¸ÅÊö


Îó²îÃû³Æ

XWiki-pro-macros Details SummaryºêÔ¶³Ì´úÂëÖ´ÐÐÎó²î

CVE   ID

CVE-2025-65036

Îó²îÀàÐÍ

RCE

·¢Ã÷ʱ¼ä

2025-12-8

Îó²îÆÀ·Ö

8.3

Îó²îÆ·¼¶

¸ßΣ

¹¥»÷ÏòÁ¿

ÍøÂç

ËùÐèȨÏÞ

µÍ

ʹÓÃÄѶÈ

µÍ

Óû§½»»¥

²»ÐèÒª

PoC/EXP

ÒѹûÕæ

ÔÚҰʹÓÃ

δ·¢Ã÷


XWikiÊÇÒ»¸ö¿ªÔ´µÄÆóÒµ¼¶ÖªÊ¶ÖÎÀíºÍЭ×÷ƽ̨£¬ÔÊÐíÓû§½¨Éè¡¢ÖÎÀíºÍ¹²ÏíÄÚÈÝ¡£Ëü»ùÓÚJavaºÍHibernate¹¹½¨£¬¾ßÓÐǿʢµÄ¿ÉÀ©Õ¹ÐÔºÍÎÞаµÄȨÏÞ¿ØÖÆ»úÖÆ£¬Ö§³Ö×Ô½ç˵À©Õ¹ºÍ¼¯³É¡£XWikiÖ÷ÒªÓÃÓÚÎĵµÖÎÀí¡¢ÏîĿЭ×÷ºÍ֪ʶ¿â½¨É裬ÆÕ±éÓ¦ÓÃÓÚÆóÒµ¡¢×éÖ¯ºÍ¿ª·¢ÕßÉçÇø¡£ËüÌṩÁ˸»ºñµÄ²å¼þºÍÄ£°å£¬¿ÉÒÔÖª×ã²î±ðÆóÒµµÄÐèÇ󣬲¢Ö§³Ö¶àÖÖÃûÌõÄÄÚÈÝչʾ¡£XWikiµÄ¿ª·ÅÔ´´úÂëʹµÃÓû§¿ÉÒÔ×ÔÓɶ¨ÖƲ¢¾ÙÐжþ´Î¿ª·¢¡£


2025Äê12ÔÂ8ÈÕ£¬×ðÁú¿­Ê±¼¯ÍÅVSRC¼à²âµ½XWiki-pro-macros Details SummaryºêÔ¶³Ì´úÂëÖ´ÐÐÎó²î£¬Ó°Ïìcom.xwiki.pro:xwiki-pro-macros-confluence-bridges-ui°ü£¬¸ÃÎó²îÔ´ÓÚConfluenceµÄDetails SummaryºêµÄʵÏÖÎÊÌ⣬ºêÔÚÖ´ÐÐVelocity¾ç±¾Ê±Î´¾ÙÐÐÊʵ±µÄȨÏÞ¼ì²é£¬µ¼ÖÂδÊÚȨµÄÓû§Äܹ»Í¨¹ý½á¹¹Ìض¨Ò³ÃæÄÚÈÝ£¬´¥·¢Ô¶³Ì´úÂëÖ´ÐС£¹¥»÷Õß¿ÉÒÔͨ¹ý½¨ÉèÒ»¸ö°üÀ¨Groovy´úÂëµÄÒì²½ºêµÄÏêÇéºêÒ³Ãæ£¬ËæºóÓÉÖÎÀíÔ±½«¸ÃÒ³ÃæÍ¨¹ýDetails Summaryºê°üÀ¨µ½ÆäËûÒ³ÃæÖУ¬´Ó¶øÖ´ÐжñÒâ´úÂë¡£¸ÃÎó²î¿Éµ¼Ö¹¥»÷ÕßÔÚûÓбà³ÌȨÏÞµÄÇéÐÎÏ£¬Í¨¹ý½á¹¹Ìض¨Ò³ÃæÄÚÈݾÙÐжñÒâ²Ù×÷£¬´Ó¶øÔÚϵͳÖÐÖ´ÐÐδ¾­ÊÚȨµÄ´úÂ룬½ø¶øÎ£º¦ÏµÍ³Çå¾²¡£


¶þ¡¢Ó°Ïì¹æÄ£


xwiki-pro-macros <= 1.27.0


Èý¡¢Çå¾²²½·¥


3.1 Éý¼¶°æ±¾


¹Ù·½ÒÑÐû²¼ÐÞ¸´²¹¶¡£¬ÒÔÐÞ¸´¸ÃÎó²î¡£
xwiki-pro-macros >= 1.27.1


ÏÂÔØÁ´½Ó£ºhttps://github.com/xwikisas/xwiki-pro-macros/tags/


3.2 ÔÝʱ²½·¥


ÔÝÎÞ¡£


3.3 ͨÓý¨Òé


? °´ÆÚ¸üÐÂϵͳ²¹¶¡£¬ïÔ̭ϵͳÎó²î£¬ÌáÉý·þÎñÆ÷µÄÇå¾²ÐÔ¡£
ÔöǿϵͳºÍÍøÂçµÄ»á¼û¿ØÖÆ£¬Ð޸ķÀ»ðǽսÂÔ£¬¹Ø±Õ·ÇÐëÒªµÄÓ¦Óö˿ڻò·þÎñ£¬ïÔÌ­½«Î£ÏÕ·þÎñ£¨ÈçSSH¡¢RDPµÈ£©Ì»Â¶µ½¹«Íø£¬ïÔÌ­¹¥»÷Ãæ¡£
ʹÓÃÆóÒµ¼¶Çå¾²²úÆ·£¬ÌáÉýÆóÒµµÄÍøÂçÇå¾²ÐÔÄÜ¡£
ÔöǿϵͳÓû§ºÍȨÏÞÖÎÀí£¬ÆôÓöàÒòËØÈÏÖ¤»úÖÆºÍ×îСȨÏÞÔ­Ôò£¬Óû§ºÍÈí¼þȨÏÞÓ¦¼á³ÖÔÚ×îµÍÏÞ¶È¡£
ÆôÓÃÇ¿ÃÜÂëÕ½ÂÔ²¢ÉèÖÃΪ°´ÆÚÐ޸ġ£


3.4 ²Î¿¼Á´½Ó


https://github.com/xwikisas/xwiki-pro-macros/security/advisories/GHSA-472x-fwh9-r82f/
https://nvd.nist.gov/vuln/detail/CVE-2025-65036