CVE-2023-26471: XWiki Platform users may execute anything with superadmin right through comments and async macro

Published Mar 2, 2023
·
Updated

XWiki Platform is a generic wiki platform. Starting in version 11.6-rc-1, comments are supposed to be executed with the right of superadmin but in restricted mode (anything dangerous is disabled), but the async macro does not take into account the restricted mode. This means that any user with comment right can use the async macro to make it execute any wiki content with the right of superadmin. This has been patched in XWiki 14.9, 14.4.6, and 13.10.10. The only known workaround consists of applying a patch and rebuilding and redeploying org.xwiki.platform:xwiki-platform-rendering-async-macro.

Affected Software

4 affected components
XWiki xwiki>=11.6<13.10.10
XWiki xwiki>=14.0<14.4.6
XWiki xwiki>=14.5<14.9
XWiki xwiki=11.6-rc1

Event History

Mar 2, 2023
CVE Published
via MITRE·06:28 PM
Data Sourced
via MITRE·06:28 PM
DescriptionSeverityWeakness

Frequently Asked Questions

1

What is the severity of CVE-2023-26471?

CVE-2023-26471 is considered a high severity vulnerability due to the potential execution of arbitrary code.

2

How do I fix CVE-2023-26471?

To fix CVE-2023-26471, you should upgrade to a version of XWiki that is later than 14.4.6 or 14.9 or post the patched versions.

3

What versions are affected by CVE-2023-26471?

CVE-2023-26471 affects XWiki versions from 11.6-rc1 up to 14.4.6 and 14.9.

4

What type of vulnerability is CVE-2023-26471?

CVE-2023-26471 is a code execution vulnerability that can be exploited due to improper handling in restricted mode.

5

Can CVE-2023-26471 be exploited remotely?

Yes, CVE-2023-26471 can potentially be exploited remotely by leveraging the async macro without proper restrictions.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203