by Kastro
Paper/Archive/CVE-2023-26475

CVE-2023-26475

xwiki xwiki-platform — XWiki Platform vulnerable to Remote Code Execution in Annotations

EPSS 64%CVSS 10.0
critical.is priorityof 100
50
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 99.2.992 × 2019.8No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

XWiki Platform is a generic wiki platform. Starting in version 2.3-milestone-1, the annotation displayer does not execute the content in a restricted context. This allows executing anything with the right of the author of any document by annotating the document. This has been patched in XWiki 13.10.11, 14.4.7 and 14.10. There is no easy workaround except to upgrade.

Affected

ProductAffectedFixed inSource
xwiki-platform>= 2.3-milestone-1, < 13.10.11–CNA
xwiki-platform>= 14.0-rc-1, < 14.4.7–CNA
xwiki-platform>= 14.5, < 14.10–CNA

Scores by source

GitHub_M (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refgithub.com/xwiki/xwiki-platform/security/advisories/GHSA-h6f5-8jj5-cxhrrefgithub.com/xwiki/xwiki-platform/commit/d87d7bfd8db18c20d3264f98c6deefeae93b99f7refjira.xwiki.org/browse/XWIKI-20360refjira.xwiki.org/browse/XWIKI-20384