PT-2023-4820 · Xwiki+1 · Xwiki Platform+1

Manuel Leduc · Published 2023-06-30 · Updated 2023-07-10 · CVE-2023-36477

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions XWiki Platform versions prior to 14.10.6 XWiki Platform versions prior to 15.1 XWiki Platform versions older than 14.6RC1 with CKEditor Integration extension prior to 1.64.9

Description The issue allows any user with edit rights to edit all pages in the CKEditor space, enabling harmful actions such as removing technical documents and editing the javascript configuration of CKEditor, leading to persistent XSS.

Recommendations For XWiki Platform versions prior to 14.10.6, upgrade to version 14.10.6 or later. For XWiki Platform versions prior to 15.1, upgrade to version 15.1 or later. For XWiki Platform versions older than 14.6RC1, update the CKEditor Integration extension to version 1.64.9 or later. As a temporary workaround, consider restricting the edit and delete rights to a trusted user or group, such as the XWiki.XWikiAdminGroup group, to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2023-05283

CVE-2023-36477

GHSA-793W-G325-HRW2

Affected Products

Ckeditor

Xwiki Platform

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/36xxx/CVE-2023-36477.json · Exploit
• 🔥 https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-793w-g325-hrw2 · Exploit
• 🔥 https://jira.xwiki.org/browse/XWIKI-20590 · Exploit
• 🔥 https://jira.xwiki.org/browse/CKEDITOR-508 · Exploit
• https://github.com/xwiki/xwiki-platform/commit/9d9d86179457cb8dc48b4491510537878800be4f · Patch
• https://bdu.fstec.ru/vul/2023-05283 · Security Note
• https://osv.dev/vulnerability/CVE-2023-36477 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-36477 · Security Note
• https://osv.dev/vulnerability/GHSA-793w-g325-hrw2 · Vendor Advisory
• https://github.com/xwiki/xwiki-platform · Note
• https://t.me/cibsecurity/65820 · Telegram Post