| CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
|---|---|---|
| 6.4 | $0-$5k | 0.00 |
Summary
A vulnerability has been found in XWiki and classified as problematic. This vulnerability affects unknown code. Performing a manipulation results in routine. This vulnerability is known as CVE-2023-26478. Remote exploitation of the attack is possible. No exploit is available. The affected component should be upgraded.
Details
A vulnerability was found in XWiki (Content Management System). It has been classified as problematic. This affects an unknown part. The manipulation with an unknown input leads to a routine vulnerability. CWE is classifying the issue as CWE-749. The product provides an Applications Programming Interface (API) or similar interface for interaction with external actors, but the interface includes a dangerous method or function that is not properly restricted. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:
XWiki Platform is a generic wiki platform. Starting in version 14.3-rc-1, `org.xwiki.store.script.TemporaryAttachmentsScriptService#uploadTemporaryAttachment` returns an instance of `com.xpn.xwiki.doc.XWikiAttachment`. This class is not supported to be exposed to users without the `programing` right. `com.xpn.xwiki.api.Attachment` should be used instead and takes case of checking the user's rights before performing dangerous operations. This has been patched in versions 14.9-rc-1 and 14.4.6. There are no known workarounds for this issue.
The weakness was published 03/02/2023 as GHSA-8692-g6g9-gm5p. The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2023-26478 since 02/23/2023. Neither technical details nor an exploit are publicly available.
Upgrading to version 14.4.6 or 14.9-rc-1 eliminates this vulnerability. Applying the patch 3c73c59e39b6436b1074d8834cf276916010014d is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Product
Type
Name
License
CPE 2.3
CPE 2.2
CVSSv4
VulDB Vector: 🔍VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 6.5VulDB Meta Temp Score: 6.4
VulDB Base Score: 4.7
VulDB Temp Score: 4.5
VulDB Vector: 🔍
VulDB Reliability: 🔍
NVD Base Score: 8.1
NVD Vector: 🔍
CNA Base Score: 6.6
CNA Vector (GitHub, Inc.): 🔍
CVSSv2
| AV | AC | Au | C | I | A |
|---|---|---|---|---|---|
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
|---|---|---|---|---|---|
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍
Exploiting
Class: RoutineCWE: CWE-749
CAPEC: 🔍
ATT&CK: 🔍
Physical: No
Local: No
Remote: Yes
Availability: 🔍
Status: Not defined
EPSS Score: 🔍
EPSS Percentile: 🔍
Price Prediction: 🔍
Current Price Estimation: 🔍
| 0-Day | Unlock | Unlock | Unlock | Unlock |
|---|---|---|---|---|
| Today | Unlock | Unlock | Unlock | Unlock |
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: UpgradeStatus: 🔍
0-Day Time: 🔍
Upgrade: XWiki 14.4.6/14.9-rc-1
Patch: 3c73c59e39b6436b1074d8834cf276916010014d
Timeline
02/23/2023 🔍03/02/2023 🔍
03/02/2023 🔍
03/30/2023 🔍
Sources
Advisory: GHSA-8692-g6g9-gm5pStatus: Confirmed
CVE: CVE-2023-26478 (🔍)
GCVE (CVE): GCVE-0-2023-26478
GCVE (VulDB): GCVE-100-222225
Entry
Created: 03/02/2023 19:38Updated: 03/30/2023 19:32
Changes: 03/02/2023 19:38 (50), 03/30/2023 19:32 (11)
Complete: 🔍
Cache ID: 216::103
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
No comments yet. Languages: en.
Please log in to comment.