PT-2023-8224 · Xwiki · Xwiki Platform

Michael Hamann · Published 2023-12-15 · Updated 2023-12-19 · CVE-2023-50722

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions XWiki Platform versions 2.3 through 14.10.14 XWiki Platform versions 14.10.15 through 15.5.1 XWiki Platform versions 15.5.2 through 15.7-rc-1

Description The issue concerns a reflected XSS or direct remote code execution vulnerability in the code for displaying configurable admin sections. This vulnerability can be exploited by passing malicious code through a URL parameter, which is executed when a user with edit rights on at least one configuration section visits the crafted URL. It does not require the attacker to have an account or access on the wiki, making it sufficient to trick an admin user into visiting the malicious URL. This vulnerability allows full remote code execution with programming rights, impacting the confidentiality, integrity, and availability of the whole XWiki installation.

Recommendations For XWiki Platform versions 2.3 through 14.10.14, update to version 14.10.15 or later. For XWiki Platform versions 14.10.15 through 15.5.1, update to version 15.5.2 or later. For XWiki Platform versions 15.5.2 through 15.7-rc-1, update to version 15.7RC1 or later. As a temporary workaround, consider restricting access to the configurable admin sections until a patch is applied. The patch can be manually applied to the document XWiki.ConfigurableClass.

Exploit

Fix

RCE

XSS

CSRF

Weakness Enumeration

CWE-79

CWE-352

Related Identifiers

BDU:2024-00230

CVE-2023-50722

GHSA-CP3J-273X-3JXC

Affected Products

Xwiki Platform

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/50xxx/CVE-2023-50722.json · Exploit
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-cp3j-273x-3jxc · Vendor Advisory
• https://github.com/xwiki/xwiki-platform/commit/5e14c8d08fd0c5b619833d35090b470aa4cb52b0 · Patch
• https://osv.dev/vulnerability/CVE-2023-50722 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-50722 · Security Note
• https://osv.dev/vulnerability/GHSA-cp3j-273x-3jxc · Vendor Advisory
• https://jira.xwiki.org/browse/XWIKI-21167 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-00230 · Security Note
• https://github.com/xwiki/xwiki-platform · Note
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-cp3j-273x-3jxcPatch · Note
• https://twitter.com/CVEnew/status/1735946020402671771 · Twitter Post
• https://t.me/cvenotify/63809 · Telegram Post
• https://t.me/cvenotify/64259 · Telegram Post