PT-2022-6848 · Unknown · Xwiki Platform

Michael Hamann · Published 2022-09-16 · Updated 2023-07-10 · CVE-2023-36468

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions XWiki Platform versions prior to 14.10.7 XWiki Platform versions prior to 15.2RC1 XWiki Platform versions prior to 13.10.6 XWiki Platform versions prior to 14.4

Description The XWiki Platform has a vulnerability that allows remote code execution, affecting the confidentiality, integrity, and availability of the whole XWiki installation. This issue arises when an XWiki installation is upgraded, and the upgrade contains a fix for a bug in a document. The vulnerability can still be exploited by adding rev=1.1 to the URL used in the reproduction steps, even after upgrading. This vulnerability also affects manually added script macros that contained security vulnerabilities that were later fixed without deleting the vulnerable versions from the history. The issue does not affect freshly installed versions of XWiki or content loaded from the current version of a document, such as wiki macros or UI extensions.

Recommendations For XWiki Platform versions prior to 14.10.7, update to version 14.10.7 or later. For XWiki Platform versions prior to 15.2RC1, update to version 15.2RC1 or later. For XWiki Platform versions prior to 13.10.6, update to version 13.10.6 or later. For XWiki Platform versions prior to 14.4, update to version 14.4 or later. As a temporary workaround, admins can manually delete old revisions of affected documents. A script can be used to identify all installed documents and delete the history for them. However, manually added and later corrected code may also be affected, so it is easy to miss documents.

Exploit

Fix

RCE

Code Injection

Improper Encoding or Escaping of Output

Eval Injection

Weakness Enumeration

CWE-94

CWE-459

CWE-116

CWE-95

Related Identifiers

BDU:2023-05132

CVE-2023-36468

GHSA-2G5C-228J-P52X

GHSA-8Q9Q-R9V2-644M

Affected Products

Xwiki Platform

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/36xxx/CVE-2023-36468.json · Exploit
• 🔥 https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-2g5c-228j-p52x · Exploit
• 🔥 https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-8q9q-r9v2-644m · Exploit
• 🔥 https://jira.xwiki.org/browse/XWIKI-20594 · Exploit
• https://github.com/xwiki/xwiki-platform/commit/15a6f845d8206b0ae97f37aa092ca43d4f9d6e59 · Patch
• https://osv.dev/vulnerability/CVE-2023-36468 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-05132 · Security Note
• https://osv.dev/vulnerability/GHSA-2g5c-228j-p52x · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-36468 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-36100 · Security Note
• https://osv.dev/vulnerability/GHSA-8q9q-r9v2-644m · Vendor Advisory
• https://github.com/xwiki/xwiki-platform · Note
• https://github.com/xwiki/xwiki-platform/commit/604868033ebd191cf2d1e94db336f0c4d9096427 · Note
• https://t.me/cvenotify/53963 · Telegram Post
• https://t.me/cibsecurity/65768 · Telegram Post