PT-2023-4819 · Xwiki · Xwiki

Michael Hamann · Published 2023-06-29 · Updated 2023-07-10 · CVE-2023-36471

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions XWiki versions 14.6RC1 through 14.10.5 XWiki versions prior to 15.2RC1

Description The issue arises from the HTML sanitizer in XWiki, which allowed form and input HTML tags since version 14.6RC1. This enables an attacker without script right to create forms for phishing attacks or add inputs that allow remote code execution when submitted by an admin. The attacker must ensure the edit form appears plausible, which can be challenging without script right.

Recommendations For XWiki versions 14.6RC1 through 14.10.5, upgrade to version 14.10.6. For XWiki versions prior to 15.2RC1, upgrade to version 15.2RC1. As a temporary workaround, an admin can manually disallow the tags by adding form, input, select, textarea, button to the configuration option xml.htmlElementSanitizer.forbidTags in the xwiki.properties configuration file.

Exploit

Fix

Special Elements Injection

XSS

Weakness Enumeration

CWE-74

CWE-79

Related Identifiers

BDU:2023-05282

CVE-2023-36471

GHSA-6PQF-C99P-758V

Affected Products

Xwiki

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/36xxx/CVE-2023-36471.json · Exploit
• 🔥 https://github.com/xwiki/xwiki-commons/security/advisories/GHSA-6pqf-c99p-758v · Exploit
• 🔥 https://jira.xwiki.org/browse/XCOMMONS-2634 · Exploit
• https://github.com/xwiki/xwiki-commons/commit/99484d48e899a68a1b6e33d457825b776c6fe8c3 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-36471 · Security Note
• https://osv.dev/vulnerability/CVE-2023-36471 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-05282 · Security Note
• https://osv.dev/vulnerability/GHSA-6pqf-c99p-758v · Vendor Advisory
• https://github.com/xwiki/xwiki-commons · Note
• https://t.me/cibsecurity/65759 · Telegram Post