PT-2023-22297 · Xwiki · Xwiki Platform

Manuel Leduc · Published 2023-04-18 · Updated 2023-04-28 · CVE-2023-29515

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions XWiki Platform versions prior to 13.10.11 XWiki Platform versions prior to 14.4.8 XWiki Platform versions prior to 14.10.1 XWiki Platform versions prior to 15.0 RC1

Description The XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user who can create a space can become admin of that space through App Within Minutes. The admin right implies the script right and thus allows JavaScript injection. The vulnerability can be exploited by creating an app in App Within Minutes. If the button should be disabled because the user doesn't have global edit right, the app can also be created by directly opening "/xwiki/bin/view/AppWithinMinutes/CreateApplication?wizard=true" on the XWiki installation.

Recommendations To resolve the issue for versions prior to 13.10.11, upgrade to version 13.10.11 or later. To resolve the issue for versions prior to 14.4.8, upgrade to version 14.4.8 or later. To resolve the issue for versions prior to 14.10.1, upgrade to version 14.10.1 or later. To resolve the issue for versions prior to 15.0 RC1, upgrade to version 15.0 RC1 or later. As a temporary workaround, consider denying view access to AppWithinMinutes.LiveTableEditSheet to prevent creation and editing of App Within Minutes apps.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-29515

GHSA-44H9-XXVX-PG6X

Affected Products

Xwiki Platform

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/29xxx/CVE-2023-29515.json · Exploit
• 🔥 https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-44h9-xxvx-pg6x · Exploit
• 🔥 https://jira.xwiki.org/browse/XWIKI-20190 · Exploit
• https://github.com/xwiki/xwiki-platform/commit/e73b890623efa604adc484ad82f37e31596fe1a6 · Patch
• https://osv.dev/vulnerability/GHSA-44h9-xxvx-pg6x · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-29515 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-29515 · Security Note
• https://github.com/xwiki/xwiki-platform · Note
• https://t.me/cvenotify/48563 · Telegram Post
• https://t.me/cibsecurity/62434 · Telegram Post
• https://t.me/cvenotify/48562 · Telegram Post