Log in Start free

Vulnerability · Published Dec 15, 2023 · Assigned by GitHub_M

CVE-2023-50723XWiki Platform remote code execution/programming rights with configuration section from any user account

Critical 10.0

In plain English

A critical-severity code injection in xwiki-platform from xwiki. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 68% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)10.0Critical
Exploit odds (30 days)1.2%top 32.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

XWiki Platform is a generic wiki platform. Starting in 2.3 and prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, anyone who can edit an arbitrary wiki page in an XWiki installation can gain programming right through several cases of missing escaping in the code for displaying sections in the administration interface. This impacts the confidentiality, integrity and availability of the whole XWiki installation. Normally, all users are allowed to edit their own user profile so this should be exploitable by all users of the XWiki instance. This has been fixed in XWiki 14.10.15, 15.5.2 and 15.7RC1. The patches can be manually applied to the `XWiki.ConfigurableClassMacros` and `XWiki.ConfigurableClass` pages.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavenorg.xwiki.platform:xwiki-platform-administration-ui14.10.15GHSA-qj86-p74r-7wp5
Mavenorg.xwiki.platform:xwiki-platform-administration-ui15.5.2GHSA-qj86-p74r-7wp5
Mavenorg.xwiki.platform:xwiki-platform-administration-ui15.7-rc-1GHSA-qj86-p74r-7wp5

Affected products (as reported)

VendorProductVersions
xwiki xwiki-platform >= 2.3, < 14.10.15>= 15.0-rc-1, < 15.5.2>= 15.6-rc-1, < 15.7-rc-1

Weakness: CWE-95, CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References