Skip to content
OpenAdvisories
Critical · 10.0 CVE-2023-26474 EUVD-2023-0846GHSA-3738-p9x3-mv9r

XWiki Platform vulnerable to privilege escalation via properties with wiki syntax that are executed with wrong author

Published Mar 2, 2023 · Updated Mar 5, 2025 · Assigned by GitHub_M

Vendor: xwiki Product: xwiki-platform Package: org.xwiki.platform:xwiki-platform-legacy-oldcore Package: org.xwiki.platform:xwiki-platform-oldcore Ecosystem: Maven

Description

XWiki Platform is a generic wiki platform. Starting in version 13.10, it's possible to use the right of an existing document content author to execute a text area property. This has been patched in XWiki 14.10, 14.4.7, and 13.10.11. There are no known workarounds.

Affected products

VendorProductAffectedFixed
xwiki xwiki-platform >= 13.10, < 13.10.11, >= 14.0, < 14.4.7, >= 14.5, < 14.10 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.xwiki.platform:xwiki-platform-legacy-oldcore >= 13.10, < 13.10.11 13.10.11 GHSA-3738-p9x3-mv9r
Maven org.xwiki.platform:xwiki-platform-legacy-oldcore >= 14.0, < 14.4.7 14.4.7 GHSA-3738-p9x3-mv9r
Maven org.xwiki.platform:xwiki-platform-legacy-oldcore >= 14.5, < 14.10 14.10 GHSA-3738-p9x3-mv9r
Maven org.xwiki.platform:xwiki-platform-oldcore >= 13.10, < 13.10.11 13.10.11 GHSA-3738-p9x3-mv9r
Maven org.xwiki.platform:xwiki-platform-oldcore >= 14.0, < 14.4.7 14.4.7 GHSA-3738-p9x3-mv9r
Maven org.xwiki.platform:xwiki-platform-oldcore >= 14.5, < 14.10 14.10 GHSA-3738-p9x3-mv9r

References