Loading...
Skip to main content
GeekWala

CVE-2023-26475 — Vulnerability in...

CRITICAL

xwiki-platform vulnerable to Remote Code Execution in Annotations

Published March 2, 2023Updated November 8, 2023Source: osv

Summary

### Impact The annotation displayer does not execute the content in a restricted context. This allows executing anything with the right of the author of any document by annotating the document. To reproduce: add an annotation with the content `{{groovy}}print "hello"{{/groovy}}` and click the yellow scare to get a display of the annotation inline. The result is "hello" but it should be an error suggesting that it's not allowed to use the groovy macro. ### Patches This has been patched in XWiki 13.10.11, 14.4.7 and 14.10. ### Workarounds There is no easy workaround except to upgrade. ### References https://jira.xwiki.org/browse/XWIKI-20360 https://jira.xwiki.org/browse/XWIKI-20384 ### For more information If you have any questions or comments about this advisory: * Open an issue in [Jira XWiki.org](https://jira.xwiki.org/) * Email us at [Security Mailing List](mailto:security@xwiki.org) ### Attribution This vulnerability has been reported by René de Sain @renniepak.

Advisory Timeline

  • First published March 2, 2023 (1320 days ago).
  • Last revised November 8, 2023 — 251 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Maven
Update org.xwiki.platform:xwiki-platform-annotation-ui to 14.4.7 or later
<!-- Update pom.xml dependency version to 14.4.7 for org.xwiki.platform:xwiki-platform-annotation-ui -->
Maven
Update org.xwiki.platform:xwiki-platform-annotation-ui to 13.10.11 or later
<!-- Update pom.xml dependency version to 13.10.11 for org.xwiki.platform:xwiki-platform-annotation-ui -->
Maven
Update org.xwiki.platform:xwiki-platform-annotation-ui to 14.10 or later
<!-- Update pom.xml dependency version to 14.10 for org.xwiki.platform:xwiki-platform-annotation-ui -->

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (3)

Affects 1 ecosystem: maven (1).

PackageEcosystemAffectedFixed In
org.xwiki.platform:xwiki-platform-annotation-ui
maven
All versions14.4.7
org.xwiki.platform:xwiki-platform-annotation-ui
maven
All versions13.10.11
org.xwiki.platform:xwiki-platform-annotation-ui
maven
All versions14.10

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.9 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2023-26475?
xwiki-platform vulnerable to Remote Code Execution in Annotations This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.9/10).
How do I check if my project is affected by CVE-2023-26475?
CVE-2023-26475 affects org.xwiki.platform:xwiki-platform-annotation-ui. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2023-26475 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
9.9

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-h6f5-8jj5-cxhr

Related CVEs

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies