Description

XWiki Platform is a generic wiki platform. Starting in version 1.3-rc-1, any user with edit right can execute arbitrary database select and access data stored in the database. The problem has been patched in XWiki 13.10.11, 14.4.7, and 14.10. There is no workaround for this vulnerability other than upgrading.

Remediation

References

CVE-2023-26473

Related Vulnerabilities

WordPress Plugin Tweet Wheel Spam (0.3)

Moodle Permissions, Privileges, and Access Controls Vulnerability (CVE-2012-4402)

WordPress Plugin DELUCKS SEO Unspecified Vulnerability (1.2.2)

MySQL CVE-2019-2596 Vulnerability (CVE-2019-2596)

WordPress Plugin Youzify-BuddyPress Community, User Profile, Social Network & Membership for WordPress Cross-Site Scripting (1.0.6)

Severity

Medium

Classification

CVE-2023-26473 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Tags

Missing Update Known Vulnerabilities