Paper/Archive/CVE-2023-46242

CVE-2023-46242

xwiki xwiki-platform — Code injection in XWiki Platform

CVSS 9.7 (CNA)9.7 / 10 × 3029.1 Not in CISA KEV+300.0 EPSS percentile 32.2.322 × 206.4 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible to execute a content with the right of any user via a crafted URL. A user must have `programming` privileges in order to exploit this vulnerability. This issue has been patched in XWiki 14.10.7 and 15.2RC1. Users are advised to upgrade. There are no known workarounds for for this vulnerability.

Affected

ProductAffectedFixed inSource

xwiki-platform>= 1.0, < 14.10.7–CNA

Scores by source

GitHub_M (CNA)9.7CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refgithub.com/xwiki/xwiki-platform/security/advisories/GHSA-hgpw-6p4h-j6h5 refgithub.com/xwiki/xwiki-platform/commit/cf8eb861998ea423c3645d2e5e974420b0e882be refjira.xwiki.org/browse/XWIKI-20386