CVE-2023-29526 — Vulnerability in...

CRITICAL

XWiki Platform's async and display macro allow displaying and interacting with any document in restricted mode

Published April 20, 2023Updated November 8, 2023Source: osv

Summary

### Impact It's possible to display any page you cannot access through the combination of the async and display macro. Steps to reproduce: 1. Enable comments for guests by giving guests comment rights 2. As a guest, create a comment with content ```{{async}}{{display reference="Menu.WebHome" /}}{{/async}}``` 3. Open the comments viewer from the menu (appends ?viewer=comments to the URL) -> the `Menu.WebHome` is displayed while the expectation would be to have an error that the current user is not allowed to see it ### Patches The vulnerability has been patched in XWiki 15.0-rc-1, 14.10.3, 14.4.8, and 13.10.11. ### Workarounds There is no known workaround. ### References https://jira.xwiki.org/browse/XWIKI-20394 https://jira.xwiki.org/browse/XRENDERING-694 ### For more information If you have any questions or comments about this advisory: * Open an issue in [Jira XWiki.org](https://jira.xwiki.org/) * Email us at [Security Mailing List](mailto:security@xwiki.org)

Advisory Timeline

First published April 20, 2023 (1271 days ago).
Last revised November 8, 2023 — 201 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Maven

Update org.xwiki.platform:xwiki-platform-rendering-async-macro to 13.10.11 or later

<!-- Update pom.xml dependency version to 13.10.11 for org.xwiki.platform:xwiki-platform-rendering-async-macro -->

Maven

Update org.xwiki.platform:xwiki-platform-oldcore to 13.10.11 or later

<!-- Update pom.xml dependency version to 13.10.11 for org.xwiki.platform:xwiki-platform-oldcore -->

Maven

Update org.xwiki.platform:xwiki-platform-rendering-async-macro to 14.10.3 or later

<!-- Update pom.xml dependency version to 14.10.3 for org.xwiki.platform:xwiki-platform-rendering-async-macro -->

Maven

Update org.xwiki.platform:xwiki-platform-rendering-async-macro to 14.4.8 or later

<!-- Update pom.xml dependency version to 14.4.8 for org.xwiki.platform:xwiki-platform-rendering-async-macro -->

Maven

Update org.xwiki.platform:xwiki-platform-oldcore to 14.10.3 or later

<!-- Update pom.xml dependency version to 14.10.3 for org.xwiki.platform:xwiki-platform-oldcore -->

Maven

Update org.xwiki.platform:xwiki-platform-oldcore to 14.4.8 or later

<!-- Update pom.xml dependency version to 14.4.8 for org.xwiki.platform:xwiki-platform-oldcore -->

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (6)

Affects 1 ecosystem: maven (2).

Package	Ecosystem	Affected	Fixed In
org.xwiki.platform:xwiki-platform-rendering-async-macro	maven	All versions	13.10.11
org.xwiki.platform:xwiki-platform-oldcore	maven	All versions	13.10.11
org.xwiki.platform:xwiki-platform-rendering-async-macro	maven	All versions	14.10.3
org.xwiki.platform:xwiki-platform-rendering-async-macro	maven	All versions	14.4.8
org.xwiki.platform:xwiki-platform-oldcore	maven	All versions	14.10.3
org.xwiki.platform:xwiki-platform-oldcore	maven	All versions	14.4.8

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-284
View on MITRE
CWE-74
View on MITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.9 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2023-29526?: XWiki Platform's async and display macro allow displaying and interacting with any document in restricted mode This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.9/10).
How do I check if my project is affected by CVE-2023-29526?: CVE-2023-29526 affects org.xwiki.platform:xwiki-platform-rendering-async-macro and org.xwiki.platform:xwiki-platform-oldcore. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2023-29526 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

9.9

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-gpq5-7p34-vqx5

Related CVEs

CVE-2023-26474
CRITICAL
XWiki Platform vulnerable to privilege escalation via properties with wiki syntax that are executed with wrong author
CVE-2023-36468
CRITICAL
Upgrading doesn't prevent exploiting vulnerable XWiki documents
CVE-2023-26471
CRITICAL
XWiki Platform users may execute anything with superadmin right through comments and async macro
CVE-2024-56158
CRITICAL
XWiki allows SQL injection in query endpoint of REST API with Oracle
CVE-2024-31981
CRITICAL
XWiki Platform: Privilege escalation (PR) from user registration through PDFClass
CVE-2024-43400
CRITICAL
XWiki Platform allows XSS through XClass name in string properties
CVE-2023-29523
CRITICAL
XWiki Platform vulnerable to code injection in display method used in user profiles
CVE-2026-40104
MEDIUM
XWiki's REST APIs can list all pages/spaces, leading to unavailability

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies