Paper/Archive/CVE-2023-29507

CVE-2023-29507

xwiki xwiki-platform — org.xwiki.platform:xwiki-platform-oldcore makes Incorrect Use of Privileged APIs with DocumentAuthors

EPSS 0.9%public exploit CVSS 9.1

critical.is priorityof 100

CVSS 9.1 (CNA)9.1 / 10 × 3027.3 Not in CISA KEV+300.0 EPSS percentile 59.6.596 × 2011.9 Exploit: SSVC poc+1010.0 SSVC exploitation: poc+100.0

Description · from the CVE record

XWiki Commons are technical libraries common to several other top level XWiki projects. The Document script API returns directly a DocumentAuthors allowing to set any authors to the document, which in consequence can allow subsequent executions of scripts since this author is used for checking rights. The problem has been patched in XWiki 14.10 and 14.4.7 by returning a safe script API.

Affected

ProductAffectedFixed inSource

xwiki-platform>= 14.5, < 14.10–CNA

xwiki-platform>= 14.4.1, < 14.4.7–CNA

Scores by source

GitHub_M (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

refgithub.com/xwiki/xwiki-platform/security/advisories/GHSA-pwfv-3cvg-9m4c refgithub.com/xwiki/xwiki-platform/commit/905cdd7c421dbf8c565557cdc773ab1aa9028f83 exploitjira.xwiki.org/browse/XWIKI-20380