CVE-2023-50723
CRITICAL
9,9
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: low
User Interaction: none
Scope: changed
Confidentiality: high
Integrity: high
Availability: high
Description
AI Translation Available
XWiki Platform is a generic wiki platform. Starting in 2.3 and prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, anyone who can edit an arbitrary wiki page in an XWiki installation can gain programming right through several cases of missing escaping in the code for displaying sections in the administration interface. This impacts the confidentiality, integrity and availability of the whole XWiki installation. Normally, all users are allowed to edit their own user profile so this should be exploitable by all users of the XWiki instance. This has been fixed in XWiki 14.10.15, 15.5.2 and 15.7RC1. The patches can be manually applied to the `XWiki.ConfigurableClassMacros` and `XWiki.ConfigurableClass` pages.
EPSS (Exploit Prediction Scoring System)
Trend Analysis
EPSS (Exploit Prediction Scoring System)
Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.
EPSS Score
0,0539
Percentile
0,9th
Updated
EPSS Score Trend (Last 90 Days)
94
Improper Control of Generation of Code ('Code Injection')
DraftCommon Consequences
Security Scopes Affected:
Access Control
Integrity
Confidentiality
Availability
Non-Repudiation
Potential Impacts:
Bypass Protection Mechanism
Gain Privileges Or Assume Identity
Execute Unauthorized Code Or Commands
Hide Activities
Applicable Platforms
Languages:
Interpreted
Technologies:
AI/ML
95
Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
IncompleteCommon Consequences
Security Scopes Affected:
Confidentiality
Access Control
Integrity
Availability
Other
Non-Repudiation
Potential Impacts:
Read Files Or Directories
Read Application Data
Bypass Protection Mechanism
Gain Privileges Or Assume Identity
Execute Unauthorized Code Or Commands
Hide Activities
Applicable Platforms
Languages:
Interpreted, Java, JavaScript, Perl, PHP, Python, Ruby
Technologies:
AI/ML
Application
Xwiki by Xwiki
Version Range Affected
From
15.0
(inclusive)
To
15.5.2
(exclusive)
CPE Identifier
View Detailed Analysis
cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application
Xwiki by Xwiki
Version Range Affected
From
2.3
(inclusive)
To
14.10.5
(exclusive)
CPE Identifier
View Detailed Analysis
cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application
Xwiki by Xwiki
CPE Identifier
View Detailed Analysis
cpe:2.3:a:xwiki:xwiki:15.6:rc1:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application
Xwiki by Xwiki
CPE Identifier
View Detailed Analysis
cpe:2.3:a:xwiki:xwiki:15.6:-:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application
Xwiki by Xwiki
CPE Identifier
View Detailed Analysis
cpe:2.3:a:xwiki:xwiki:15.7:rc1:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
https://github.com/xwiki/xwiki-platform/commit/0f367aaae4e0696f61cf5a67a75edd27…
https://github.com/xwiki/xwiki-platform/commit/1157c1ecea395aac7f64cd8a6f484b12…
https://github.com/xwiki/xwiki-platform/commit/749f6aee1bfbcf191c3734ea0aa9eba3…
https://github.com/xwiki/xwiki-platform/commit/bd82be936c21b65dee367d558e3050b9…
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-qj86-p74r-7wp5
https://jira.xwiki.org/browse/XWIKI-21121
https://jira.xwiki.org/browse/XWIKI-21122
https://jira.xwiki.org/browse/XWIKI-21194
https://github.com/xwiki/xwiki-platform/commit/0f367aaae4e0696f61cf5a67a75edd27…
https://github.com/xwiki/xwiki-platform/commit/1157c1ecea395aac7f64cd8a6f484b12…
https://github.com/xwiki/xwiki-platform/commit/749f6aee1bfbcf191c3734ea0aa9eba3…
https://github.com/xwiki/xwiki-platform/commit/bd82be936c21b65dee367d558e3050b9…
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-qj86-p74r-7wp5
https://jira.xwiki.org/browse/XWIKI-21121
https://jira.xwiki.org/browse/XWIKI-21122
https://jira.xwiki.org/browse/XWIKI-21194