Vulnerability · Published Mar 2, 2023 · Assigned by GitHub_M

CVE-2023-26473XWiki Platform allows unprivileged users to make arbitrary select queries using DatabaseListProperty and suggest.vm

Medium 6.5

In plain English

A medium-severity improper access control in xwiki-platform from xwiki. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.6%top 49.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

XWiki Platform is a generic wiki platform. Starting in version 1.3-rc-1, any user with edit right can execute arbitrary database select and access data stored in the database. The problem has been patched in XWiki 13.10.11, 14.4.7, and 14.10. There is no workaround for this vulnerability other than upgrading.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	org.xwiki.platform:xwiki-platform-web	13.10.11	GHSA-vpx4-7rfp-h545
Maven	org.xwiki.platform:xwiki-platform-web	14.4.7	GHSA-vpx4-7rfp-h545
Maven	org.xwiki.platform:xwiki-platform-web	14.10	GHSA-vpx4-7rfp-h545

Affected products (as reported)

Vendor	Product	Versions
xwiki	xwiki-platform	>= 1.3-rc-1, < 13.10.11>= 14.0, < 14.4.7>= 14.5, < 14.10

Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-vpx4-7rfp-h545 x_refsource_CONFIRM
https://jira.xwiki.org/browse/XWIKI-19523 x_refsource_MISC