9.9 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
0.001 Low
EPSS
Percentile
46.4%
One can execute any wiki content with the right of IconThemeSheet author by creating an icon theme with the following content:
}}}
{{async async="true"}}
{{groovy}}
println("Hello from Groovy!")
{{/groovy}}
{{/async}}
{{{
Can be done by creating a new page or even through the user profile for users not having edit right.
This has been patched in XWiki 14.9, 14.4.6, and 13.10.10.
An easy workaround is to actually fix the bug in the page IconThemesCode.IconThemeSheet
by applying the following modification: https://github.com/xwiki/xwiki-platform/commit/48caf7491595238af2b531026a614221d5d61f38#diff-2ec9d716673ee049937219cdb0a92e520f81da14ea84d144504b97ab2bdae243R45
https://jira.xwiki.org/browse/XWIKI-19731
If you have any questions or comments about this advisory:
github.com/xwiki/xwiki-platform
github.com/xwiki/xwiki-platform/commit/48caf7491595238af2b531026a614221d5d61f38#diff-2ec9d716673ee049937219cdb0a92e520f81da14ea84d144504b97ab2bdae243R45
github.com/xwiki/xwiki-platform/security/advisories/GHSA-vwr6-qp4q-2wj7
jira.xwiki.org/browse/XWIKI-19731
nvd.nist.gov/vuln/detail/CVE-2023-26472