Vulnerability · Published Apr 16, 2023 · Assigned by GitHub_M
CVE-2023-29507org.xwiki.platform:xwiki-platform-oldcore makes Incorrect Use of Privileged APIs with DocumentAuthors
Critical 9.1
In plain English
A critical-severity security flaw in xwiki-platform from xwiki. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
XWiki Commons are technical libraries common to several other top level XWiki projects. The Document script API returns directly a DocumentAuthors allowing to set any authors to the document, which in consequence can allow subsequent executions of scripts since this author is used for checking rights. The problem has been patched in XWiki 14.10 and 14.4.7 by returning a safe script API.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.xwiki.platform:xwiki-platform-oldcore | 14.10 | GHSA-pwfv-3cvg-9m4c |
| Maven | org.xwiki.platform:xwiki-platform-oldcore | 14.4.7 | GHSA-pwfv-3cvg-9m4c |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| xwiki | xwiki-platform | >= 14.5, < 14.10>= 14.4.1, < 14.4.7 |
Weakness: CWE-648 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
References
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-pwfv-3cvg-9m4c x_refsource_CONFIRM
- https://github.com/xwiki/xwiki-platform/commit/905cdd7c421dbf8c565557cdc773ab1aa9028f83 x_refsource_MISC
- https://jira.xwiki.org/browse/XWIKI-20380 x_refsource_MISC