9.9

CVE-2023-26472

Exploit

XWiki Platform is a generic wiki platform. Starting in version 6.2-milestone-1, one can execute any wiki content with the right of IconThemeSheet author by creating an icon theme with certain content. This can be done by creating a new page or even through the user profile for users not having edit right. The issue has been patched in XWiki 14.9, 14.4.6, and 13.10.10. An available workaround is to fix the bug in the page `IconThemesCode.IconThemeSheet` by applying a modification from commit 48caf7491595238af2b531026a614221d5d61f38.

Data is provided by the National Vulnerability Database (NVD)
Xwiki ≫ Xwiki Version >= 6.2.1 < 13.10.10
Xwiki ≫ Xwiki Version >= 14.0 < 14.4.6
Xwiki ≫ Xwiki Version >= 14.5 < 14.9
Xwiki ≫ Xwiki Version6.2 Updatemilestone1
Xwiki ≫ Xwiki Version6.2 Updatemilestone2
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 1.42% 0.794
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
security-advisories@github.com 9.9 3.1 6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CWE-116 Improper Encoding or Escaping of Output

The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

https://jira.xwiki.org/browse/XWIKI-19731
Patch
Vendor Advisory
Exploit
Issue Tracking