CVE-2023-26475

CRITICAL

XWiki Platform <2.3-milestone-1 - RCE

Title source: llm
STIX 2.1

Description

XWiki Platform is a generic wiki platform. Starting in version 2.3-milestone-1, the annotation displayer does not execute the content in a restricted context. This allows executing anything with the right of the author of any document by annotating the document. This has been patched in XWiki 13.10.11, 14.4.7 and 14.10. There is no easy workaround except to upgrade.

References (4)

Core 4
Core References
Exploit, Issue Tracking, Patch, Vendor Advisory x_refsource_misc
https://jira.xwiki.org/browse/XWIKI-20360
Issue Tracking, Patch, Vendor Advisory x_refsource_misc
https://jira.xwiki.org/browse/XWIKI-20384

Scores

CVSS v3 9.9
EPSS 0.3475
EPSS Percentile 97.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-269 CWE-270
Status published
Products (3)
org.xwiki.platform/xwiki-platform-annotation-ui 2.3-milestone-1 - 13.10.11Maven
xwiki/xwiki 2.3 milestone1
xwiki/xwiki 2.3 - 13.10.11
Published Mar 02, 2023
Tracked Since Feb 18, 2026