CVE-2023-26475

See a problem?
Please try reporting it to the source first.

Source

https://nvd.nist.gov/vuln/detail/CVE-2023-26475

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-26475.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2023-26475

Aliases

GHSA-h6f5-8jj5-cxhr

Published

2023-03-02T18:07:04Z

Modified

2025-11-13T15:13:31.215428Z

Severity

9.9 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVSS Calculator

Summary

XWiki Platform vulnerable to Remote Code Execution in Annotations

Details

XWiki Platform is a generic wiki platform. Starting in version 2.3-milestone-1, the annotation displayer does not execute the content in a restricted context. This allows executing anything with the right of the author of any document by annotating the document. This has been patched in XWiki 13.10.11, 14.4.7 and 14.10. There is no easy workaround except to upgrade.

Database specific

{
    "cwe_ids": [
        "CWE-269",
        "CWE-270"
    ]
}

References

Affected packages

Git / github.com/xwiki/xwiki-commons

Affected ranges

Type: GIT
Repo: https://github.com/xwiki/xwiki-commons
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

8d72461ba6976af6005e2df511bdeeeb17ef2d74

Git / github.com/xwiki/xwiki-platform

Affected ranges

Type: GIT
Repo: https://github.com/xwiki/xwiki-platform
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

d87d7bfd8db18c20d3264f98c6deefeae93b99f7

Affected versions

xwiki-application-calendar-1.*

xwiki-application-calendar-1.0

xwiki-platform-7.*

xwiki-platform-7.3-milestone-2

xwiki-platform-7.4-milestone-1

xwiki-platform-7.4-milestone-2

xwiki-platform-8.*

xwiki-platform-8.0-milestone-1

xwiki-platform-8.0-milestone-2

xwiki-platform-8.1-milestone-1

xwiki-platform-8.1-milestone-2

xwiki-platform-8.2-milestone-1

xwiki-platform-8.2-milestone-2

xwiki-platform-8.3-milestone-1

xwiki-platform-9.*

xwiki-platform-9.9-rc-2

xwiki-plugin-tag-1.*

xwiki-plugin-tag-1.1

Database specific

vanir_signatures

[
    {
        "deprecated": false,
        "source": "https://github.com/xwiki/xwiki-platform/commit/d87d7bfd8db18c20d3264f98c6deefeae93b99f7",
        "id": "CVE-2023-26475-19c6adb3",
        "digest": {
            "line_hashes": [
                "285296424547583777226917884155526099993",
                "312545047070604324818801527925236788835",
                "172224469010375989546485546614920626137",
                "2763878448666103614938382864509993657"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/internal/mandatory/XWikiCommentsDocumentInitializer.java"
        },
        "signature_type": "Line",
        "signature_version": "v1"
    },
    {
        "deprecated": false,
        "source": "https://github.com/xwiki/xwiki-platform/commit/d87d7bfd8db18c20d3264f98c6deefeae93b99f7",
        "id": "CVE-2023-26475-d970a8cb",
        "digest": {
            "function_hash": "111025794934607162321120671317497078571",
            "length": 347.0
        },
        "target": {
            "function": "createClass",
            "file": "xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/internal/mandatory/XWikiCommentsDocumentInitializer.java"
        },
        "signature_type": "Function",
        "signature_version": "v1"
    }
]