5.4 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
7.1 High
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
35.2%
It’s possible to execute a script with the right of another user (provided the target user does not have programming right).
For example, the following:
{{context document="xwiki:XWiki.userwithscriptright" transformationContext="document"}}{{velocity}}Hello from Velocity!{{/velocity}}{{/context}}
written by a user not having script right (for example in the user’s profile) should produce an error (the user is not allowed to write scripts). However, because of the vulnerability, if the author of the document “xwiki:XWiki.userwithscriptright” has script right (but not programming right) the script will be executed with as if it was written by the target user.
The problem has been patched in XWiki 14.8RC1, 14.4.5 and 13.10.10.
There’s no workaround for this issue.
https://jira.xwiki.org/browse/XWIKI-19856
If you have any questions or comments about this advisory:
github.com/xwiki/xwiki-platform
github.com/xwiki/xwiki-platform/commit/4b75f212c2dd2dfc5fb5726c7830c6dbc9a425c6
github.com/xwiki/xwiki-platform/commit/bd34ad6710ed72304304a3d5fec38b7cc050ef3b
github.com/xwiki/xwiki-platform/commit/dd3f4735b41971b3afc3f3aedf6664b4e8be4894
github.com/xwiki/xwiki-platform/security/advisories/GHSA-859x-p6jp-rc2w
jira.xwiki.org/browse/XWIKI-19856
nvd.nist.gov/vuln/detail/CVE-2023-26056
5.4 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
7.1 High
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
35.2%