CVE-2023-26055: XWiki Commons may allow privilege escalation to programming rights via user's first name
First published: Thu Mar 02 2023(Updated: )
XWiki Commons are technical libraries common to several other top level XWiki projects. Starting in version 3.1-milestone-1, any user can edit their own profile and inject code, which is going to be executed with programming right. The same vulnerability can also be exploited in all other places where short text properties are displayed, e.g., in apps created using Apps Within Minutes that use a short text field. The problem has been patched on versions 13.10.9, 14.4.4, 14.7RC1.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| XWiki | >=3.2<13.10.9 | |
| XWiki | >=14.4<14.4.4 | |
| XWiki | >=14.5<14.7 | |
| XWiki | =3.1-milestone1 | |
| XWiki | =3.1-milestone2 | |
| XWiki | =3.1.1 | |
| XWiki | =14.4-rc1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2023-26055?
CVE-2023-26055 is a critical vulnerability in XWiki Commons that allows any user to inject code into their own profile, which is executed with programming rights.
How can this vulnerability be exploited?
This vulnerability can be exploited by users injecting code into their own profile or in other locations in XWiki Commons.
Which versions of XWiki Commons are affected?
XWiki Commons versions 3.1-milestone-1 to 13.10.9 and versions 14.4 to 14.4.4 are affected by this vulnerability.
What is the severity of CVE-2023-26055?
CVE-2023-26055 has a severity rating of 9.9 (Critical).
Are there any references or advisories for CVE-2023-26055?
Yes, you can find more information on this vulnerability at the following references: [link1], [link2], [link3].
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/remedy
- agent/source
- agent/weakness
- agent/last-modified-date
- agent/author
- agent/severity
- agent/description
- agent/first-publish-date
- agent/event
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/xwiki
- canonical/xwiki
- version/xwiki/3.2
- version/xwiki/14.4
- version/xwiki/14.5
- version/xwiki/3.1-milestone1
- version/xwiki/3.1-milestone2
- version/xwiki/3.1.1
- version/xwiki/14.4-rc1