Vulnerability · Published Mar 2, 2023 · Assigned by GitHub_M

CVE-2023-26470In XWiki Platform, saving a document with a large object number leads to persistent OOM errors

Medium 5.7

In plain English

A medium-severity uncontrolled resource consumption in xwiki-platform from xwiki. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.7Medium

Exploit odds (30 days)0.9%top 41.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to make the farm unusable by adding an object to a page with a huge number (e.g. 67108863). Most of the time this will fill the memory allocated to XWiki and make it unusable every time this document is manipulated. This issue has been patched in XWiki 14.0-rc-1.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	org.xwiki.platform:xwiki-platform-oldcore	14.0-rc-1	GHSA-92wp-r7hm-42g7

Affected products (as reported)

Vendor	Product	Versions
xwiki	xwiki-platform	< 14.0-rc-1

Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

References

https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-92wp-r7hm-42g7 x_refsource_CONFIRM
https://github.com/xwiki/xwiki-platform/commit/04e5a89d2879b160cdfaea846024d3d9c1a525e6 x_refsource_MISC
https://github.com/xwiki/xwiki-platform/commit/db3d1c62fc5fb59fefcda3b86065d2d362f55164 x_refsource_MISC
https://github.com/xwiki/xwiki-platform/commit/fdfce062642b0ac062da5cda033d25482f4600fa x_refsource_MISC
https://jira.xwiki.org/browse/XWIKI-19223 x_refsource_MISC