CVE-2023-26055

CRITICAL9.9EPSS 4.9%

XWiki Platform may allow privilege escalation to programming rights via user's first name

發布日:2023/3/3修改日:2023/11/8

描述

### Impact Any user can edit his own profile and inject code which is going to be executed with programming right. Steps to reproduce: * Set your first name to ``` {{cache id="userProfile"}}{{groovy}}println("Hello from groovy!"){{/groovy}}{{/cache}} ``` The first name appears as interpreted "`Hello from groovy`" instead of the expected fully escaped "`{{cache id="userProfile"}}{{groovy}}println("Hello from groovy!"){{/groovy}}{{/cache}}`". The same vulnerability can also be exploited in all other places where short text properties are displayed, e.g., in apps created using [Apps Within Minutes](https://extensions.xwiki.org/xwiki/bin/view/Extension/App%20Within%20Minutes%20Application) that use a short text field. ### Patches The problem has been patched on versions 13.10.9, 14.4.4, 14.7RC1. ### Workarounds There are no other workarounds than upgrading XWiki or patching the xwiki-commons-xml JAR file. ### References * https://jira.xwiki.org/browse/XWIKI-19793 * https://jira.xwiki.org/browse/XWIKI-19794 * https://jira.xwiki.org/browse/XCOMMONS-2498 ### For more information If you have any questions or comments about this advisory: * Open an issue in [Jira XWiki.org](https://jira.xwiki.org/) * Email us at [Security Mailing List](mailto:[email protected])

受影響套件(1)

CVSS 分數

來源版本嚴重程度向量
osvCVSS 3.1CRITICAL9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

參考連結(6)