CVE-2023-26475

high-risk
Published 2023-03-02

XWiki Platform is a generic wiki platform. Starting in version 2.3-milestone-1, the annotation displayer does not execute the content in a restricted context. This allows executing anything with the right of the author of any document by annotating the document. This has been patched in XWiki 13.10.11, 14.4.7 and 14.10. There is no easy workaround except to upgrade.

Do I need to act?

!
34.7% chance of exploitation in next 30 days
EPSS score — higher than 65% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
+
Fix available
Upgrade to: 08e0887f0362b21614e6bfcb5be7e1f568659c41, 962ee4ac0352ab1a89cc779c29e81b0674d0203e, c524887d154ff8f6df9651e36b904e234bf5a6ef
9
CVSS 9.9/10 Critical
NETWORK / LOW complexity

Affected Products (2)

Affected Vendors

Xwiki

References (8)

Patch https://github.com/xwiki/xwiki-platform/commit/d87d7bfd8db18c20d3264f98c6deefeae...
Exploit https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-h6f5-8jj5-cxhr
Exploit https://jira.xwiki.org/browse/XWIKI-20360
Issue Tracking https://jira.xwiki.org/browse/XWIKI-20384
Patch https://github.com/xwiki/xwiki-platform/commit/d87d7bfd8db18c20d3264f98c6deefeae...
Exploit https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-h6f5-8jj5-cxhr
Exploit https://jira.xwiki.org/browse/XWIKI-20360
Issue Tracking https://jira.xwiki.org/browse/XWIKI-20384
56
/ 100
high-risk
Severity 33/34 · Critical
Exploitability 16/34 · Moderate
Exposure 7/34 · Low