Vulnerability Description
XWiki Platform is a generic wiki platform. Starting in version 12.9-rc-1 and prior to versions 14.4.8, 14.10.6, and 15.1, any logged in user can add dangerous content in their first name field and see it executed with programming rights. Leading to rights escalation. The vulnerability has been fixed on XWiki 14.4.8, 14.10.6, and 15.1. As a workaround, one may apply the patch manually.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Xwiki | Xwiki | >= 12.9, < 14.4.8 |
Related Weaknesses (CWE)
References
- https://github.com/xwiki/xwiki-platform/commit/0993a7ab3c102f9ac37ffe361a83a3dc3PatchVendor Advisory
- https://github.com/xwiki/xwiki-platform/commit/6ce2d04a5779e07f6d3ed3f37d4761049PatchVendor Advisory
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-rf8j-q39g-7xfmVendor Advisory
- https://jira.xwiki.org/browse/XWIKI-19900Issue TrackingVendor Advisory
- https://jira.xwiki.org/browse/XWIKI-20611Issue TrackingVendor Advisory
- https://github.com/xwiki/xwiki-platform/commit/0993a7ab3c102f9ac37ffe361a83a3dc3PatchVendor Advisory
- https://github.com/xwiki/xwiki-platform/commit/6ce2d04a5779e07f6d3ed3f37d4761049PatchVendor Advisory
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-rf8j-q39g-7xfmVendor Advisory
- https://jira.xwiki.org/browse/XWIKI-19900Issue TrackingVendor Advisory
- https://jira.xwiki.org/browse/XWIKI-20611Issue TrackingVendor Advisory
FAQ
What is CVE-2023-35152?
CVE-2023-35152 is a vulnerability with a CVSS score of 9.9 (CRITICAL). XWiki Platform is a generic wiki platform. Starting in version 12.9-rc-1 and prior to versions 14.4.8, 14.10.6, and 15.1, any logged in user can add dangerous content in their first name field and see...
How severe is CVE-2023-35152?
CVE-2023-35152 has been rated CRITICAL with a CVSS base score of 9.9/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2023-35152?
Check the references section above for vendor advisories and patch information. Affected products include: Xwiki Xwiki.