CVE-2023-26474: XWiki Platform vulnerable to privilege escalation via properties with wiki syntax that are executed with wrong author
XWiki Platform is a generic wiki platform. Starting in version 13.10, it's possible to use the right of an existing document content author to execute a text area property. This has been patched in XWiki 14.10, 14.4.7, and 13.10.11. There are no known workarounds.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2023-26474?
CVE-2023-26474 is classified as a high severity vulnerability affecting the XWiki Platform.
How do I fix CVE-2023-26474?
To fix CVE-2023-26474, upgrade your XWiki installation to version 14.10, 14.4.7, or 13.10.11 or later.
Which versions of XWiki are affected by CVE-2023-26474?
CVE-2023-26474 affects XWiki versions between 13.10 and 13.10.10, and between 14.0 and 14.4.7.
Are there any known workarounds for CVE-2023-26474?
There are no known workarounds for CVE-2023-26474.
What is the impact of CVE-2023-26474 on the XWiki Platform?
CVE-2023-26474 allows an attacker to leverage an existing document content author's rights to execute unauthorized actions within the XWiki Platform.