GitHub Advisoryadvisory · Maven
GHSA-92wp-r7hm-42g7 XWiki Platform subject to Uncontrolled Resource Consumption
MEDIUM
Official page ↗
- Aliases
- CVE-2023-26470
- Ecosystem
- Maven
- Packages
- org.xwiki.platform:xwiki-platform-oldcore
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
- Weaknesses
- CWE-400, CWE-787
- Reviewed
- 2023-03-03
Affected packages
• Maven org.xwiki.platform:xwiki-platform-oldcore: < 14.0-rc-1 → fixed in 14.0-rc-1
Description
Impact
It's possible to make the farm unusable by adding an object to a page with a huge number (e.g. 67108863). This will most of the time fill the memory allocated to XWiki and make it unusable every time this document is manipulated.
Patches
It has been patched in XWiki 14.0
Workarounds
There is no workaround.
References
https://jira.xwiki.org/browse/XWIKI-19223
For more information
If you have any questions or comments about this advisory:
• Open an issue in Jira XWiki
• Email us at our security mailing list
Related
Alias · CVE (1)
- CVE-2023-26470 XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. vulnerability
References
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-92wp-r7hm-42g7 web
- https://nvd.nist.gov/vuln/detail/CVE-2023-26470 advisory
- https://github.com/xwiki/xwiki-platform/commit/04e5a89d2879b160cdfaea846024d3d9c1a525e6 web
- https://github.com/xwiki/xwiki-platform/commit/db3d1c62fc5fb59fefcda3b86065d2d362f55164 web
- https://github.com/xwiki/xwiki-platform/commit/fdfce062642b0ac062da5cda033d25482f4600fa web
- https://github.com/xwiki/xwiki-platform package
- https://jira.xwiki.org/browse/XWIKI-19223 web