QwikSec

Security Database

CVE

CWE

Training

CVE-2023-26055

Published: Mar 2, 2023

Modified: Mar 5, 2025

PUBLISHED

CVSS v3.1

10.0

CRITICAL

Description

XWiki Commons are technical libraries common to several other top level XWiki projects. Starting in version 3.1-milestone-1, any user can edit their own profile and inject code, which is going to be executed with programming right. The same vulnerability can also be exploited in all other places where short text properties are displayed, e.g., in apps created using Apps Within Minutes that use a short text field. The problem has been patched on versions 13.10.9, 14.4.4, 14.7RC1.

Vendor	Product	Versions
xwiki	xwiki-commons	affected `>= 3.1-milestone-1, < 13.10.9` affected `>= 14.0-rc-1, < 14.4.4` affected `>= 14.5, < 14.7-rc-1`

Weaknesses (CWE)

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

References

https://github.com/xwiki/xwiki-commons/security/advisories/GHSA-8cw6-4r32-6r3h

x_refsource_CONFIRM

https://jira.xwiki.org/browse/XCOMMONS-2498

x_refsource_MISC

https://jira.xwiki.org/browse/XWIKI-19793

x_refsource_MISC

https://jira.xwiki.org/browse/XWIKI-19794

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.