What is the severity of CVE-2023-26471?

CVE-2023-26471 is considered a high severity vulnerability due to the potential execution of arbitrary code.

How do I fix CVE-2023-26471?

To fix CVE-2023-26471, you should upgrade to a version of XWiki that is later than 14.4.6 or 14.9 or post the patched versions.

What versions are affected by CVE-2023-26471?

CVE-2023-26471 affects XWiki versions from 11.6-rc1 up to 14.4.6 and 14.9.

What type of vulnerability is CVE-2023-26471?

CVE-2023-26471 is a code execution vulnerability that can be exploited due to improper handling in restricted mode.

Can CVE-2023-26471 be exploited remotely?

Yes, CVE-2023-26471 can potentially be exploited remotely by leveraging the async macro without proper restrictions.

Vulnerability/
CVE-2023-26471

critical

CWE

284

2/3/2023

2/8/2024

CVE-2023-26471: XWiki Platform users may execute anything with superadmin right through comments and async macro

First published: Thu Mar 02 2023(Updated: )

XWiki Platform is a generic wiki platform. Starting in version 11.6-rc-1, comments are supposed to be executed with the right of superadmin but in restricted mode (anything dangerous is disabled), but the async macro does not take into account the restricted mode. This means that any user with comment right can use the async macro to make it execute any wiki content with the right of superadmin. This has been patched in XWiki 14.9, 14.4.6, and 13.10.10. The only known workaround consists of applying a patch and rebuilding and redeploying `org.xwiki.platform:xwiki-platform-rendering-async-macro`.

Credit: security-advisories@github.com

Affected Software	Affected Version	How to fix
Xwiki	>=11.6<13.10.10
Xwiki	>=14.0<14.4.6
Xwiki	>=14.5<14.9
Xwiki	=11.6-rc1

Remedy

https://github.com/xwiki/xwiki-platform/commit/00532d9f1404287cf3ec3a05056640d809516006

Remedy

https://jira.xwiki.org/browse/XWIKI-20234

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is the severity of CVE-2023-26471?
CVE-2023-26471 is considered a high severity vulnerability due to the potential execution of arbitrary code.
How do I fix CVE-2023-26471?
To fix CVE-2023-26471, you should upgrade to a version of XWiki that is later than 14.4.6 or 14.9 or post the patched versions.
What versions are affected by CVE-2023-26471?
CVE-2023-26471 affects XWiki versions from 11.6-rc1 up to 14.4.6 and 14.9.
What type of vulnerability is CVE-2023-26471?
CVE-2023-26471 is a code execution vulnerability that can be exploited due to improper handling in restricted mode.
Can CVE-2023-26471 be exploited remotely?
Yes, CVE-2023-26471 can potentially be exploited remotely by leveraging the async macro without proper restrictions.

agent/type
agent/remedy
agent/softwarecombine
collector/mitre-cve
source/MITRE
agent/weakness
agent/title
agent/references
agent/severity
agent/last-modified-date
agent/author
agent/description
agent/first-publish-date
agent/event
agent/source
agent/tags
collector/nvd-index
agent/software-canonical-lookup-request
vendor/xwiki
canonical/xwiki
version/xwiki/11.6
version/xwiki/14.0
version/xwiki/14.5
version/xwiki/11.6-rc1

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.