CVEvulnerability

CVE-2023-26475

8.8 HIGH Published 2023-03-02 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2023-03-02
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.9 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS 3.1 ([email protected])
8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-269, CWE-270

Description

XWiki Platform is a generic wiki platform. Starting in version 2.3-milestone-1, the annotation displayer does not execute the content in a restricted context. This allows executing anything with the right of the author of any document by annotating the document. This has been patched in XWiki 13.10.11, 14.4.7 and 14.10. There is no easy workaround except to upgrade.

Affected configurations

• xwiki xwiki (> 2.3 < 13.10.11) • xwiki xwiki (>= 14.0 < 14.4.7) • xwiki xwiki (>= 14.5 < 14.10) • xwiki xwiki 2.3

Related

Weakness · CWE (2)

  • CWE-269 Improper Privilege Management weakness
  • CWE-270 Privilege Context Switching Error weakness

References