Critical severity · published Mar 2, 2023
CVE-2023-26055
XWiki Commons are technical libraries common to several other top level XWiki projects
9.9
CVSS
1.2%
EPSS
No
On KEV
Description
XWiki Commons are technical libraries common to several other top level XWiki projects. Starting in version 3.1-milestone-1, any user can edit their own profile and inject code, which is going to be executed with programming right. The same vulnerability can also be exploited in all other places where short text properties are displayed, e.g., in apps created using Apps Within Minutes that use a short text field. The problem has been patched on versions 13.10.9, 14.4.4, 14.7RC1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 67% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
Commons · Xwiki
3.2 before 13.10.9; 14.4 before 14.4.4; 14.5 before 14.7; 3.1; 3.1; 3.1.1; +1 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-26055
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-26055
Exploit
https://github.com/xwiki/xwiki-commons/security/advisories/GHSA-8cw6-4r32-6r3h
Issue Tracking
https://jira.xwiki.org/browse/XCOMMONS-2498
Exploit
https://jira.xwiki.org/browse/XWIKI-19793
Exploit
https://jira.xwiki.org/browse/XWIKI-19794
More from Commons
9.8
CVE-2024-31996
XWiki Commons missing escaping of `{` in Velocity escapetool allows remote code execution
9.0
CVE-2023-29528
XWiki Commons are technical libraries common to several other top level XWiki projects
5.4
CVE-2023-36471
HTML sanitizer allows form elements in restricted in org.xwiki.commons:xwiki-commons-xml
4.9
CVE-2022-24898
org.xwiki.commons:xwiki-commons-xml is a common module used by other XWiki top level projects