CVE-2023-26475: XWiki Platform vulnerable to Remote Code Execution in Annotations
First published: Thu Mar 02 2023(Updated: )
XWiki Platform is a generic wiki platform. Starting in version 2.3-milestone-1, the annotation displayer does not execute the content in a restricted context. This allows executing anything with the right of the author of any document by annotating the document. This has been patched in XWiki 13.10.11, 14.4.7 and 14.10. There is no easy workaround except to upgrade.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Xwiki | >2.3<13.10.11 | |
| Xwiki | >=14.0<14.4.7 | |
| Xwiki | >=14.5<14.10 | |
| Xwiki | =2.3-milestone1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2023-26475?
CVE-2023-26475 has been classified with a high severity due to its potential for unauthorized actions by document authors.
How do I fix CVE-2023-26475?
To fix CVE-2023-26475, you should update to the patched versions of XWiki that address this vulnerability.
Which versions of XWiki are affected by CVE-2023-26475?
CVE-2023-26475 affects XWiki versions between 2.3-milestone-1 and 14.4.7, as well as certain versions within this range.
What type of vulnerability is CVE-2023-26475?
CVE-2023-26475 is a security vulnerability that allows execution of content in an improper context based on document annotation.
What can attackers do with CVE-2023-26475?
Attackers can exploit CVE-2023-26475 to execute arbitrary code or actions as the author of a document due to improper context restrictions.
- agent/references
- agent/weakness
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/remedy
- agent/severity
- agent/last-modified-date
- agent/author
- agent/description
- agent/first-publish-date
- agent/event
- agent/type
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/softwarecombine
- vendor/xwiki
- canonical/xwiki
- version/xwiki/14.0
- version/xwiki/14.5
- version/xwiki/2.3-milestone1