Description

XWiki Platform is a generic wiki platform. Starting in version 2.3-milestone-1, the annotation displayer does not execute the content in a restricted context. This allows executing anything with the right of the author of any document by annotating the document. This has been patched in XWiki 13.10.11, 14.4.7 and 14.10. There is no easy workaround except to upgrade.

Remediation

References

https://github.com/xwiki/xwiki-platform/commit/d87d7bfd8db18c20d3264f98c6deefeae93b99f7

https://jira.xwiki.org/browse/XWIKI-20360

https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-h6f5-8jj5-cxhr

https://jira.xwiki.org/browse/XWIKI-20384

Related Vulnerabilities

CVE-2018-1000665 Vulnerability in maven package org.webjars:dojo

CVE-2009-0217 Vulnerability in maven package org.apache.santuario:xmlsec

CVE-2022-1291 Vulnerability in maven package org.webjars.npm:github-com-hhurz-tableexport-jquery-plugin

CVE-2023-25158 Vulnerability in maven package org.geotools.jdbc:gt-jdbc-postgis

CVE-2016-10735 Vulnerability in maven package ua.mobius.media:bootstrap

Severity

Critical

Classification

CWE-269 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Patch Exploit Issue Tracking Vendor Advisory