Lucene search

GitHub_MCVE-2023-32071

HistoryMay 09, 2023 - 4:15 p.m.

CVE-2023-32071

2023-05-0916:15:15

CWE-116

CWE-79

GitHub_M

web.nvd.nist.gov

xwiki

platform

cve-2023-32071

security

vulnerability

javascript

patch

nvd

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

AI Score

9.1

Confidence

High

EPSS

0.003

Percentile

69.3%

JSON

XWiki Platform is a generic wiki platform. Starting in versions 2.2-milestone-1 and prior to versions 14.4.8, 14.10.4, and 15.0-rc-1, it’s possible to execute javascript with the right of any user by leading him to a special URL on the wiki targeting a page which contains an attachment. This has been patched in XWiki 15.0-rc-1, 14.10.4, and 14.4.8. The easiest possible workaround is to edit file <xwiki app>/templates/importinline.vm and apply the modification described in commit 28905f7f518cc6f21ea61fe37e9e1ed97ef36f01.

Affected configurations

Nvd

Vulners

Node

xwikixwikiRange2.3–14.4.8

xwikixwikiRange14.5.0–14.10.4

xwikixwikiMatch2.2milestone1

VendorProductVersionCPE
xwikixwiki*cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*
xwikixwiki2.2cpe:2.3:a:xwiki:xwiki:2.2:milestone1:*:*:*:*:*:*

Vendor	Product	Version	CPE
xwiki	xwiki	*	cpe:2.3:a:xwiki:xwiki::::::::
xwiki	xwiki	2.2	cpe:2.3:a:xwiki:xwiki:2.2:milestone1::::::

CNA Affected

[
  {
    "vendor": "xwiki",
    "product": "xwiki-platform",
    "versions": [
      {
        "version": ">= 2.2-milestone-1, < 14.4.8",
        "status": "affected"
      },
      {
        "version": ">= 14.5, < 14.10.4",
        "status": "affected"
      }
    ]
  }
]

References

app.intigriti.com/company/submissions/e95a7ad5-7029-4627-abf0-3e3e3ea0b4ce/XWIKI-E93DFEYK

github.com/xwiki/xwiki-platform/commit/28905f7f518cc6f21ea61fe37e9e1ed97ef36f01

github.com/xwiki/xwiki-platform/security/advisories/GHSA-j9h5-vcgv-2jfm

jira.xwiki.org/browse/XWIKI-20340

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

AI Score

9.1

Confidence

High

EPSS

0.003

Percentile

69.3%

JSON

Related for CVE-2023-32071