CVE-2023-26472

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-26472
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-26472.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-26472
Aliases
Published
2023-03-02T18:25:06Z
Modified
2026-10-24T14:37:29Z
Severity
  • 9.9 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
Summary
XWiki Platform vulnerable to privilege escalation via async macro and IconThemeSheet from the user profile
Details

XWiki Platform is a generic wiki platform. Starting in version 6.2-milestone-1, one can execute any wiki content with the right of IconThemeSheet author by creating an icon theme with certain content. This can be done by creating a new page or even through the user profile for users not having edit right. The issue has been patched in XWiki 14.9, 14.4.6, and 13.10.10. An available workaround is to fix the bug in the page IconThemesCode.IconThemeSheet by applying a modification from commit 48caf7491595238af2b531026a614221d5d61f38.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-116"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/26xxx/CVE-2023-26472.json"
}
References

Affected packages

Git / github.com/xwiki/xwiki-commons

Affected ranges

Type
GIT
Repo
https://github.com/xwiki/xwiki-commons
Events
Introduced
75947046d8ce1c942b6355740686f6673dc8aff8
Fixed
bc18e50bcf9ea40d1e25ff8d065b3178c8247f16
Introduced
491547c4f74b9be58123ef22081ae7e6840a11c7
Fixed
61952343490e97926364658196c63936e0b384c5
Introduced
bae1e23e73cafc007e5f28b39a04bfa0acf0199c
Fixed
c2eb37f9cb37dab85f673e2151a323ff0074a365
Introduced
e39d89e23a136223735afe358fa72f14cf6ff90a
Last Affected
e39d89e23a136223735afe358fa72f14cf6ff90a
Database specific
Show details 
{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "6.2.1"
                },
                {
                    "fixed":  "13.10.10"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:xwiki:xwiki:6.2:milestone1:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "6.2-milestone1"
                },
                {
                    "last_affected":  "6.2-milestone1"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "14.0"
                },
                {
                    "fixed":  "14.4.6"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "14.5"
                },
                {
                    "fixed":  "14.9"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:xwiki:xwiki:6.2:milestone2:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "6.2-milestone2"
                },
                {
                    "last_affected":  "6.2-milestone2"
                }
            ],
            "source":  "CPE_STRING"
        }
    ]
}
Type
GIT
Repo
https://github.com/xwiki/xwiki-platform
Events
Introduced
86fedf2c46d0514ea65038cdcea3f75e3a36aab5
Fixed
61a67f5cf241df692779d77367168e0762119091
Introduced
d971304b0e0bf4f6dad278de89518edc17459741
Fixed
4db5104960c1c13a7d2b740800e2b9d0091444d8
Introduced
ab4dfeaeef13360eebcaa507bc652073aa89a427
Fixed
101becab4069ae9ccdc8c2f2c4edc562645e152b
Introduced
3faaa3b41b298b5b1f3a03865bcbe8266c9fedd5
Fixed
48caf7491595238af2b531026a614221d5d61f38
Database specific
Show details 
{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "6.2.1"
                },
                {
                    "fixed":  "13.10.10"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:xwiki:xwiki:6.2:milestone1:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "6.2-milestone1"
                },
                {
                    "last_affected":  "6.2-milestone1"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "14.0"
                },
                {
                    "fixed":  "14.4.6"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "14.5"
                },
                {
                    "fixed":  "14.9"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:xwiki:xwiki:6.2:milestone2:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "6.2-milestone2"
                },
                {
                    "last_affected":  "6.2-milestone2"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "range":  [
                {
                    "fixed":  "48caf7491595238af2b531026a614221d5d61f38"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

6.*
6.2-milestone2
xwiki-commons-6.*
xwiki-commons-6.2.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-26472.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "241436754504398272115648114039472953574",
                "91322937624014975635415446494396992257",
                "32103860525410293523379766074701381496",
                "251605682384583568173130527076895348872",
                "176551276031469405012969301531465065399",
                "249738932794603918895147802874559061868",
                "237442739760926075942755818721344793633",
                "130673880832601592644806389243963285305",
                "325709585179185583938258691930285524337",
                "232692643542311480839110895877709850802",
                "271270627431092994921900384647716790093",
                "147301953474738703334801375231293423059",
                "163957069989654941094346220246830015359",
                "263229491503953019806419193904670929484",
                "68509759500716473715608746482911164635",
                "254770110771673016696578075623870701522",
                "221369428011411488614213454908029643030",
                "129053359995965941106466394826931947357",
                "198466006606398407417315422343812703261",
                "15460976080312045789568412561963791854",
                "272194200802180404642967107862461350221",
                "45278952514421645158794402732721465786",
                "225970964121589067238554686818687468426",
                "306012811753088034862851382009846738112",
                "237489778573347151907735532903319859318"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2023-26472-3a4b15b4",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/xwiki/xwiki-platform/commit/48caf7491595238af2b531026a614221d5d61f38",
        "target":  {
            "file":  "xwiki-platform-core/xwiki-platform-icon/xwiki-platform-icon-test/xwiki-platform-icon-test-docker/src/test/it/org/xwiki/icon/test/ui/IconThemesSheetIT.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "99005501258412968266234264224712886451",
            "length":  57
        },
        "id":  "CVE-2023-26472-e14c9718",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/xwiki/xwiki-platform/commit/48caf7491595238af2b531026a614221d5d61f38",
        "target":  {
            "file":  "xwiki-platform-core/xwiki-platform-icon/xwiki-platform-icon-test/xwiki-platform-icon-test-docker/src/test/it/org/xwiki/icon/test/ui/IconThemesSheetIT.java",
            "function":  "setUp"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "83324234962206109018852746895563801560",
            "length":  353
        },
        "id":  "CVE-2023-26472-f4f9daf6",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/xwiki/xwiki-platform/commit/48caf7491595238af2b531026a614221d5d61f38",
        "target":  {
            "file":  "xwiki-platform-core/xwiki-platform-icon/xwiki-platform-icon-test/xwiki-platform-icon-test-docker/src/test/it/org/xwiki/icon/test/ui/IconThemesSheetIT.java",
            "function":  "createIconTheme"
        }
    }
]
vanir_signatures_modified 
"2026-10-24T14:37:29Z"