PT-2023-4810 · Unknown · Xwiki Platform

Michael Hamann · Published 2023-09-01 · Updated 2023-09-08 · CVE-2023-41046

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions XWiki Platform versions prior to 14.10.10 XWiki Platform versions prior to 15.4 RC1

Description The issue is related to errors in authorization, allowing a remote attacker to execute arbitrary web scripts with elevated privileges. In XWiki, it is possible to execute Velocity code without having script right by creating an XClass with a property of type "TextArea" and content type "VelocityCode" or "VelocityWiki". The Velocity code is executed regardless of the rights of the author of the property, although edit right is still required. This behavior could allow further privilege escalation.

Recommendations For XWiki Platform versions prior to 14.10.10, upgrade to version 14.10.10 or later. For XWiki Platform versions prior to 15.4 RC1, upgrade to version 15.4 RC1 or later. As a temporary workaround, consider restricting access to the Velocity code execution feature until a patch is applied. Avoid using the "VelocityCode" or "VelocityWiki" content types in the "TextArea" property until the issue is resolved.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2023-05273

CVE-2023-41046

GHSA-M5M2-H6H9-P2C8

Affected Products

Xwiki Platform

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/41xxx/CVE-2023-41046.json · Exploit
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-m5m2-h6h9-p2c8 · Patch
• https://github.com/xwiki/xwiki-platform/commit/edc52579eeaab1b4514785c134044671a1ecd839 · Patch
• https://jira.xwiki.org/browse/XWIKI-20847 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-41046 · Vendor Advisory
• https://jira.xwiki.org/browse/XWIKI-20848 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-05273 · Security Note
• https://osv.dev/vulnerability/GHSA-m5m2-h6h9-p2c8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-41046 · Security Note
• https://github.com/xwiki/xwiki-platform · Note
• https://t.me/cvenotify/57751 · Telegram Post
• https://twitter.com/vuldb/status/1698086154741162463 · Twitter Post
• https://twitter.com/Avertium/status/1700228765509456296 · Twitter Post
• https://t.me/cibsecurity/69697 · Telegram Post