CVE-2023-26474 — XWiki Platform vulnerable to privilege escalation via properties with wiki syntax that are executed with wrong author

CVE-2023-26474

XWiki Platform vulnerable to privilege escalation via properties with wiki syntax that are executed with wrong author PUBLISHED

Description (CNA)

XWiki Platform is a generic wiki platform. Starting in version 13.10, it's possible to use the right of an existing document content author to execute a text area property. This has been patched in XWiki 14.10, 14.4.7, and 13.10.11. There are no known workarounds.

Affected (CNA)

Vendor / product	Versions
xwiki / xwiki-platform	affected >= 13.10, < 13.10.11; affected >= 14.0, < 14.4.7; affected >= 14.5, < 14.10

CWE

CWE-284

References

https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-3738-p9x3-mv9r
https://jira.xwiki.org/browse/XWIKI-20373

ADP enrichment

CVE

No English description supplied.

https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-3738-p9x3-mv9r
https://jira.xwiki.org/browse/XWIKI-20373

CISA-ADP

No English description supplied.

No references supplied.