From fcc9f51bfdf09f720ab10ecaf7f1c1a72f148e47 Mon Sep 17 00:00:00 2001
From: Andre Eleuterio <me@andreeleuterio.com>
Date: Thu, 10 Sep 2020 16:36:28 -0300
Subject: [PATCH] Add CVE-2020-15171 for GHSA-7qw5-pqhc-xm4g

---
 2020/15xxx/CVE-2020-15171.json | 80 +++++++++++++++++++++++++++++++---
 1 file changed, 74 insertions(+), 6 deletions(-)

diff --git a/2020/15xxx/CVE-2020-15171.json b/2020/15xxx/CVE-2020-15171.json
index b3b20de3d01..dd1326e12c5 100644
--- a/2020/15xxx/CVE-2020-15171.json
+++ b/2020/15xxx/CVE-2020-15171.json
@@ -1,18 +1,86 @@
 {
-    "data_type": "CVE",
-    "data_format": "MITRE",
-    "data_version": "4.0",
     "CVE_data_meta": {
+        "ASSIGNER": "security-advisories@github.com",
         "ID": "CVE-2020-15171",
-        "ASSIGNER": "cve@mitre.org",
-        "STATE": "RESERVED"
+        "STATE": "PUBLIC",
+        "TITLE": "Users with SCRIPT rights can execute arbitrary code in XWiki"
     },
+    "affects": {
+        "vendor": {
+            "vendor_data": [
+                {
+                    "product": {
+                        "product_data": [
+                            {
+                                "product_name": "xwiki-platform",
+                                "version": {
+                                    "version_data": [
+                                        {
+                                            "version_value": "<11.10.5"
+                                        },
+                                        {
+                                            "version_value": ">=12.0.0, <12.2.1"
+                                        }
+                                    ]
+                                }
+                            }
+                        ]
+                    },
+                    "vendor_name": "xwiki"
+                }
+            ]
+        }
+    },
+    "data_format": "MITRE",
+    "data_type": "CVE",
+    "data_version": "4.0",
     "description": {
         "description_data": [
             {
                 "lang": "eng",
-                "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+                "value": "In XWiki before versions 11.10.5 or 12.2.1, any user with SCRIPT right (EDIT right before XWiki 7.4) can gain access to the application server Servlet context which contains tools allowing to instantiate arbitrary Java objects and invoke methods that may lead to arbitrary code execution. The only workaround is to give SCRIPT right only to trusted users."
             }
         ]
+    },
+    "impact": {
+        "cvss": {
+            "attackComplexity": "HIGH",
+            "attackVector": "NETWORK",
+            "availabilityImpact": "HIGH",
+            "baseScore": 6.6,
+            "baseSeverity": "MEDIUM",
+            "confidentialityImpact": "HIGH",
+            "integrityImpact": "HIGH",
+            "privilegesRequired": "HIGH",
+            "scope": "UNCHANGED",
+            "userInteraction": "NONE",
+            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
+            "version": "3.1"
+        }
+    },
+    "problemtype": {
+        "problemtype_data": [
+            {
+                "description": [
+                    {
+                        "lang": "eng",
+                        "value": "CWE-94: Improper Control of Generation of Code ('Code Injection')"
+                    }
+                ]
+            }
+        ]
+    },
+    "references": {
+        "reference_data": [
+            {
+                "name": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-7qw5-pqhc-xm4g",
+                "refsource": "CONFIRM",
+                "url": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-7qw5-pqhc-xm4g"
+            }
+        ]
+    },
+    "source": {
+        "advisory": "GHSA-7qw5-pqhc-xm4g",
+        "discovery": "UNKNOWN"
     }
 }
\ No newline at end of file