Paper/Archive/CVE-2023-35152

CVE-2023-35152

xwiki xwiki-platform — XWiki Platform vulnerable to privilege escalation (PR) from account through like LiveTableResults

EPSS 1%public exploit CVSS 10.0

critical.is priorityof 100

CVSS 10.0 (CNA)10.0 / 10 × 3030.0 Not in CISA KEV+300.0 EPSS percentile 63.4.634 × 2012.7 Exploit: SSVC poc+1010.0 SSVC exploitation: poc+100.0

Description · from the CVE record

XWiki Platform is a generic wiki platform. Starting in version 12.9-rc-1 and prior to versions 14.4.8, 14.10.6, and 15.1, any logged in user can add dangerous content in their first name field and see it executed with programming rights. Leading to rights escalation. The vulnerability has been fixed on XWiki 14.4.8, 14.10.6, and 15.1. As a workaround, one may apply the patch manually.

Affected

ProductAffectedFixed inSource

xwiki-platform>= 12.9-rc-1, < 14.4.8–CNA

xwiki-platform>= 14.5, < 14.10.6–CNA

xwiki-platform>= 15.0-rc-1, < 15.1–CNA

Scores by source

GitHub_M (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

refgithub.com/xwiki/xwiki-platform/security/advisories/GHSA-rf8j-q39g-7xfm refgithub.com/xwiki/xwiki-platform/commit/0993a7ab3c102f9ac37ffe361a83a3dc302c0e45#diff-0b51114cb27f7a5c599cf40c59d658eae6ddc5c0836532c3b35e163f40a4854fR39 refgithub.com/xwiki/xwiki-platform/commit/6ce2d04a5779e07f6d3ed3f37d4761049b4fc3ac#diff-ef7f8b911bb8e584fda22aac5876a329add35ca0d1d32e0fdb62a439b78cfa49 refjira.xwiki.org/browse/XWIKI-19900 refjira.xwiki.org/browse/XWIKI-20611