CVE-2023-26478: org.xwiki.platform:xwiki-platform-store-filesystem-oldcore has Exposed Dangerous Method or Function
XWiki Platform is a generic wiki platform. Starting in version 14.3-rc-1, org.xwiki.store.script.TemporaryAttachmentsScriptService#uploadTemporaryAttachment returns an instance of com.xpn.xwiki.doc.XWikiAttachment. This class is not supported to be exposed to users without the programing right. com.xpn.xwiki.api.Attachment should be used instead and takes case of checking the user's rights before performing dangerous operations. This has been patched in versions 14.9-rc-1 and 14.4.6. There are no known workarounds for this issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2023-26478.
What is the severity of CVE-2023-26478?
The severity of CVE-2023-26478 is high, with a CVSS score of 8.1.
What is the description of CVE-2023-26478?
CVE-2023-26478 is a vulnerability in XWiki Platform where starting in version 14.3-rc-1, a certain script service method exposes a class that should not be accessible without proper permissions.
Which version of XWiki Platform is affected by CVE-2023-26478?
Versions 14.3-rc-1 to 14.4.6 and versions 14.5 to 14.9 of XWiki Platform are affected by CVE-2023-26478.
How can CVE-2023-26478 be fixed?
To fix CVE-2023-26478, users should update to a version of XWiki Platform that is not affected by the vulnerability, such as versions after 14.9.