Description

XWiki Platform is a generic wiki platform. Starting in version 1.3-rc-1, any user with edit right can execute arbitrary database select and access data stored in the database. The problem has been patched in XWiki 13.10.11, 14.4.7, and 14.10. There is no workaround for this vulnerability other than upgrading.

Remediation

References

https://jira.xwiki.org/browse/XWIKI-19523

https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-vpx4-7rfp-h545

Related Vulnerabilities

CVE-2023-33962 Vulnerability in maven package io.jstach:jstachio

CVE-2021-23337 Vulnerability in npm package lodash

CVE-2023-25572 Vulnerability in npm package ra-ui-materialui

CVE-2019-10806 Vulnerability in maven package org.webjars.npm:vega-util

CVE-2021-23440 Vulnerability in npm package set-value

Severity

High

Classification

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Tags

Exploit Issue Tracking Patch Vendor Advisory NVD-CWE-noinfo