Vulnerability Details : CVE-2023-35152
XWiki Platform is a generic wiki platform. Starting in version 12.9-rc-1 and prior to versions 14.4.8, 14.10.6, and 15.1, any logged in user can add dangerous content in their first name field and see it executed with programming rights. Leading to rights escalation. The vulnerability has been fixed on XWiki 14.4.8, 14.10.6, and 15.1. As a workaround, one may apply the patch manually.
Products affected by CVE-2023-35152
- cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*
- cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*
- cpe:2.3:a:xwiki:xwiki:15.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:xwiki:xwiki:15.0:*:*:*:*:*:*:*
- cpe:2.3:a:xwiki:xwiki:12.9:rc1:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2023-35152
0.21%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 59 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2023-35152
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
8.8
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
2.8
|
5.9
|
NIST | |
|
9.9
|
CRITICAL | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
3.1
|
6.0
|
GitHub, Inc. |
CWE ids for CVE-2023-35152
-
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.Assigned by: nvd@nist.gov (Primary)
-
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").Assigned by: security-advisories@github.com (Secondary)
References for CVE-2023-35152
-
https://github.com/xwiki/xwiki-platform/commit/0993a7ab3c102f9ac37ffe361a83a3dc302c0e45#diff-0b51114cb27f7a5c599cf40c59d658eae6ddc5c0836532c3b35e163f40a4854fR39
XWIKI-17733: Use a LiveTable to display the page liked in user profile · xwiki/xwiki-platform@0993a7a · GitHubPatch;Vendor Advisory
-
https://jira.xwiki.org/browse/XWIKI-19900
[XWIKI-19900] Liked page whose FULLNAME contains dot(.) can not show in user profile. - XWiki.org JIRAIssue Tracking;Vendor Advisory
-
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-rf8j-q39g-7xfm
Privilege escalation (PR) from account through like LiveTableResults · Advisory · xwiki/xwiki-platform · GitHubVendor Advisory
-
https://jira.xwiki.org/browse/XWIKI-20611
[XWIKI-20611] Privilege escalation (PR) from account through like LiveTableResults - XWiki.org JIRAIssue Tracking;Vendor Advisory
-
https://github.com/xwiki/xwiki-platform/commit/6ce2d04a5779e07f6d3ed3f37d4761049b4fc3ac#diff-ef7f8b911bb8e584fda22aac5876a329add35ca0d1d32e0fdb62a439b78cfa49
XWIKI-19900: Liked page whose FULLNAME contains dot(.) can not show i… · xwiki/xwiki-platform@6ce2d04 · GitHubPatch;Vendor Advisory
Jump to