CVE-2023-26475: XWiki Platform vulnerable to Remote Code Execution in Annotations
XWiki Platform is a generic wiki platform. Starting in version 2.3-milestone-1, the annotation displayer does not execute the content in a restricted context. This allows executing anything with the right of the author of any document by annotating the document. This has been patched in XWiki 13.10.11, 14.4.7 and 14.10. There is no easy workaround except to upgrade.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2023-26475?
CVE-2023-26475 has been classified with a high severity due to its potential for unauthorized actions by document authors.
How do I fix CVE-2023-26475?
To fix CVE-2023-26475, you should update to the patched versions of XWiki that address this vulnerability.
Which versions of XWiki are affected by CVE-2023-26475?
CVE-2023-26475 affects XWiki versions between 2.3-milestone-1 and 14.4.7, as well as certain versions within this range.
What type of vulnerability is CVE-2023-26475?
CVE-2023-26475 is a security vulnerability that allows execution of content in an improper context based on document annotation.
What can attackers do with CVE-2023-26475?
Attackers can exploit CVE-2023-26475 to execute arbitrary code or actions as the author of a document due to improper context restrictions.