CVE-2023-26473: XWiki Platform allows unprivileged users to make arbitrary select queries using DatabaseListProperty and suggest.vm
XWiki Platform is a generic wiki platform. Starting in version 1.3-rc-1, any user with edit right can execute arbitrary database select and access data stored in the database. The problem has been patched in XWiki 13.10.11, 14.4.7, and 14.10. There is no workaround for this vulnerability other than upgrading.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2023-26473?
CVE-2023-26473 is a high severity vulnerability that allows users with edit rights to execute arbitrary database queries.
How do I fix CVE-2023-26473?
To fix CVE-2023-26473, upgrade to XWiki version 13.10.11, 14.4.7, or 14.10.
Who is affected by CVE-2023-26473?
CVE-2023-26473 affects all versions of XWiki from 1.3-rc-1 up to 13.10.10, 14.0 to 14.4.6, and 14.5 to 14.9.
What type of vulnerability is CVE-2023-26473?
CVE-2023-26473 is a database access vulnerability that allows unauthorized data exposure.
Can CVE-2023-26473 be exploited remotely?
Yes, CVE-2023-26473 can be exploited remotely by any authenticated user with edit permissions.