CVE-2023-29526: Improper Neutralization of Special Elements in Output Used by a Downstream Component

🗓️ 18 Apr 2023 00:00:00Reported by Rapid7Type

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible to display or interact with any page a user cannot access through the combination of the async and display ...

Reporter	Title	Published	Views	Family All 12
BDU FSTEC	The vulnerability of the XWiki Platform, which exists due to the lack of measures to neutralize special elements, allows a violator to gain unauthorized access to any arbitrary page.	14 Feb 202400:00	–	bdu_fstec
CNNVD	XWiki Platform 注入漏洞	18 Apr 202300:00	–	cnnvd
CVE	CVE-2023-29526	18 Apr 202322:57	–	cve
Cvelist	CVE-2023-29526 Async and display macro allow displaying and interacting with any document in restricted mode	18 Apr 202322:57	–	cvelist
EUVD	EUVD-2023-1312	3 Oct 202520:07	–	euvd
Github Security Blog	XWiki Platform's async and display macro allow displaying and interacting with any document in restricted mode	20 Apr 202322:24	–	github
NVD	CVE-2023-29526	19 Apr 202300:15	–	nvd
OpenVAS	XWiki 10.11.1 < 13.10.11, 14.0-rc-1 < 14.4.8, 14.5 < 14.10.3 Privilege Escalation Vulnerability (GHSA-gpq5-7p34-vqx5)	13 Jul 202300:00	–	openvas
OSV	GHSA-GPQ5-7P34-VQX5 XWiki Platform's async and display macro allow displaying and interacting with any document in restricted mode	20 Apr 202322:24	–	osv
Prion	Code injection	19 Apr 202300:15	–	prion