CVE-2023-26470 In XWiki Platform, saving a document with a large object number leads to persistent OOM errors

2023-03-0218:37:23

CWE-400

GitHub_M

www.cve.org

cve-2023-26470

xwiki platform

oom error

large object number

persistent

memory allocation

patch

5.7 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

0.001 Low

EPSS

Percentile

43.2%

JSON

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It’s possible to make the farm unusable by adding an object to a page with a huge number (e.g. 67108863). Most of the time this will fill the memory allocated to XWiki and make it unusable every time this document is manipulated. This issue has been patched in XWiki 14.0-rc-1.

CNA Affected

[
  {
    "vendor": "xwiki",
    "product": "xwiki-platform",
    "versions": [
      {
        "version": "< 14.0-rc-1",
        "status": "affected"
      }
    ]
  }
]