CVE-2023-26474: XWiki Platform vulnerable to privilege escalation via properties with wiki syntax that are executed with wrong author

March 3, 2023

XWiki Platform is a generic wiki platform. Starting in version 13.10, it’s possible to use the right of an existing document content author to execute a text area property. This has been patched in XWiki 14.10, 14.4.7, and 13.10.11. There are no known workarounds.

References

github.com/advisories/GHSA-3738-p9x3-mv9r
github.com/xwiki/xwiki-platform/security/advisories/GHSA-3738-p9x3-mv9r
jira.xwiki.org/browse/XWIKI-20373
nvd.nist.gov/vuln/detail/CVE-2023-26474

Detect and mitigate CVE-2023-26474 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →