XWiki Commons may allow privilege escalation to programming rights via user's first name
CVE-2023-26055

10CRITICAL

Key Information:

Vendor
Xwiki
Status
Xwiki-commons
Vendor
CVE Published:
2 March 2023

Summary

A vulnerability in XWiki Commons allows unauthorized users to inject and execute code by modifying their profile. This flaw, affecting versions starting from 3.1-milestone-1, can also be exploited in applications using short text properties, enabling potential execution of malicious code. Affected users should upgrade to versions 13.10.9, 14.4.4, or 14.7RC1 to mitigate risks.

Affected Version(s)

xwiki-commons >= 3.1-milestone-1, < 13.10.9 < 3.1-milestone-1, 13.10.9

xwiki-commons >= 14.0-rc-1, < 14.4.4 < 14.0-rc-1, 14.4.4

xwiki-commons >= 14.5, < 14.7-rc-1 < 14.5, 14.7-rc-1

References

https://github.com/xwiki/xwiki-commons/security/advisorie...
x_refsource_CONFIRM
https://jira.xwiki.org/browse/XCOMMONS-2498
x_refsource_MISC
https://jira.xwiki.org/browse/XWIKI-19793
x_refsource_MISC

EPSS Score

10% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.