A vulnerability, which was classified as critical, has been found in XWiki Platform (Content Management System). This issue affects an unknown part. The manipulation with an unknown input leads to a escape output vulnerability. Using CWE to declare the problem leads to CWE-116. The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

XWiki Platform is a generic wiki platform. Starting in version 6.2-milestone-1, one can execute any wiki content with the right of IconThemeSheet author by creating an icon theme with certain content. This can be done by creating a new page or even through the user profile for users not having edit right. The issue has been patched in XWiki 14.9, 14.4.6, and 13.10.10. An available workaround is to fix the bug in the page `IconThemesCode.IconThemeSheet` by applying a modification from commit 48caf7491595238af2b531026a614221d5d61f38.

The weakness was shared 03/03/2023 as GHSA-vwr6-qp4q-2wj7. It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2023-26472 since 02/23/2023. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 13.10.10, 14.4.6 or 14.9 eliminates this vulnerability. Applying the patch 48caf7491595238af2b531026a614221d5d61f38 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Productinfo

Type

• Content Management System

Name

• XWiki Platform

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion