PT-2023-20455 · Xwiki · Xwiki Commons

Michael Hamann · Published 2023-03-01 · Updated 2023-03-13 · CVE-2023-26055

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions XWiki Commons versions 3.1-milestone-1 through 13.10.8 XWiki Commons versions 14.0.0 through 14.4.3 XWiki Commons versions 14.5.0 through 14.7RC0

Description The issue allows any user to edit their own profile and inject code, which is executed with programming rights. This can also be exploited in other places where short text properties are displayed, such as in apps created using Apps Within Minutes that use a short text field.

Recommendations For versions 3.1-milestone-1 through 13.10.8, update to version 13.10.9 or later. For versions 14.0.0 through 14.4.3, update to version 14.4.4 or later. For versions 14.5.0 through 14.7RC0, update to version 14.7RC1 or later. As a temporary workaround, consider restricting access to short text properties until a patch is applied.

Exploit

Fix

Weakness Enumeration

CWE-150

Related Identifiers

CVE-2023-26055

GHSA-8CW6-4R32-6R3H

Affected Products

Xwiki Commons

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/26xxx/CVE-2023-26055.json · Exploit
• 🔥 https://github.com/xwiki/xwiki-commons/security/advisories/GHSA-8cw6-4r32-6r3h · Exploit
• 🔥 https://jira.xwiki.org/browse/XWIKI-19793 · Exploit
• 🔥 https://jira.xwiki.org/browse/XWIKI-19794 · Exploit
• https://jira.xwiki.org/browse/XCOMMONS-2498 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-26055 · Security Note
• https://osv.dev/vulnerability/GHSA-8cw6-4r32-6r3h · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-26055 · Vendor Advisory
• https://github.com/xwiki/xwiki-commons · Note
• https://t.me/cibsecurity/59329 · Telegram Post