CVE-2023-35152
- Source
- https://cve.org/CVERecord?id=CVE-2023-35152
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-35152.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2023-35152
- Aliases
- Published
- 2023-06-23T16:41:51.268Z
- Modified
- 2026-07-22T02:25:13.190001Z
- Severity
-
- 9.9 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
- Summary
- XWiki Platform vulnerable to privilege escalation (PR) from account through like LiveTableResults
- Details
-
XWiki Platform is a generic wiki platform. Starting in version 12.9-rc-1 and prior to versions 14.4.8, 14.10.6, and 15.1, any logged in user can add dangerous content in their first name field and see it executed with programming rights. Leading to rights escalation. The vulnerability has been fixed on XWiki 14.4.8, 14.10.6, and 15.1. As a workaround, one may apply the patch manually.
- Database specific
{ "cwe_ids": [ "CWE-95" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/35xxx/CVE-2023-35152.json", "cna_assigner": "GitHub_M" }- References
-
- https://jira.xwiki.org/browse/XWIKI-19900
- https://jira.xwiki.org/browse/XWIKI-20611
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/35xxx/CVE-2023-35152.json
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-rf8j-q39g-7xfm
- https://nvd.nist.gov/vuln/detail/CVE-2023-35152
- https://github.com/xwiki/xwiki-platform/commit/0993a7ab3c102f9ac37ffe361a83a3dc302c0e45#diff-0b51114cb27f7a5c599cf40c59d658eae6ddc5c0836532c3b35e163f40a4854fR39
- https://github.com/xwiki/xwiki-platform/commit/6ce2d04a5779e07f6d3ed3f37d4761049b4fc3ac#diff-ef7f8b911bb8e584fda22aac5876a329add35ca0d1d32e0fdb62a439b78cfa49
Affected packages
Git / github.com/xwiki/xwiki-commons
Affected ranges
- Type
- GIT
- Repo
- https://github.com/xwiki/xwiki-commons
- Events
-
IntroducedFixedIntroducedFixedIntroducedLast affected
- Database specific
{ "cpe": [ "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*", "cpe:2.3:a:xwiki:xwiki:15.0:*:*:*:*:*:*:*" ], "source": [ "CPE_RANGE", "CPE_STRING" ], "extracted_events": [ { "introduced": "12.9" }, { "fixed": "14.4.8" }, { "introduced": "14.10" }, { "fixed": "14.10.6" }, { "introduced": "15.0" }, { "last_affected": "15.0" } ] }
- Type
- GIT
- Repo
- https://github.com/xwiki/xwiki-platform
- Events
-
IntroducedFixedIntroducedFixedIntroducedFixedFixed
- Database specific
{ "cpe": [ "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*", "cpe:2.3:a:xwiki:xwiki:15.0:*:*:*:*:*:*:*" ], "source": [ "CPE_RANGE", "CPE_STRING", "REFERENCES" ], "extracted_events": [ { "introduced": "12.9" }, { "fixed": "14.4.8" }, { "introduced": "14.10" }, { "fixed": "14.10.6" }, { "introduced": "15.0" }, { "last_affected": "15.0" } ] }
Affected versions
15.*
15.0
xwiki-commons-14.*
xwiki-commons-14.10
xwiki-commons-14.10.1
xwiki-commons-14.10.2
xwiki-commons-14.10.3
xwiki-commons-14.10.4
xwiki-commons-14.10.5
xwiki-commons-15.*
xwiki-commons-15.0
xwiki-platform-14.*
xwiki-platform-14.10
xwiki-platform-14.10.1
xwiki-platform-14.10.2
xwiki-platform-14.10.3
xwiki-platform-14.10.4
xwiki-platform-14.10.5
Database specific
vanir_signatures_modified
"2026-07-22T02:25:13Z"
vanir_signatures
[
{
"signature_type": "Function",
"target": {
"file": "xwiki-platform-core/xwiki-platform-like/xwiki-platform-like-api/src/main/java/org/xwiki/like/internal/DefaultLikeManager.java",
"function": "dispose"
},
"deprecated": false,
"source": "https://github.com/xwiki/xwiki-platform/commit/0993a7ab3c102f9ac37ffe361a83a3dc302c0e45",
"id": "CVE-2023-35152-002459f5",
"signature_version": "v1",
"digest": {
"function_hash": "108013058048315318989389995389115188975",
"length": 57.0
}
},
{
"signature_type": "Line",
"target": {
"file": "xwiki-platform-core/xwiki-platform-like/xwiki-platform-like-api/src/test/java/org/xwiki/like/internal/DefaultLikeManagerTest.java"
},
"deprecated": false,
"source": "https://github.com/xwiki/xwiki-platform/commit/0993a7ab3c102f9ac37ffe361a83a3dc302c0e45",
"id": "CVE-2023-35152-14d4562e",
"signature_version": "v1",
"digest": {
"line_hashes": [
"78092718867657142493592034427816036413",
"3583382527629898726239598230472055319"
],
"threshold": 0.9
}
},
{
"signature_type": "Line",
"target": {
"file": "xwiki-platform-core/xwiki-platform-like/xwiki-platform-like-api/src/main/java/org/xwiki/like/script/LikeScriptService.java"
},
"deprecated": false,
"source": "https://github.com/xwiki/xwiki-platform/commit/0993a7ab3c102f9ac37ffe361a83a3dc302c0e45",
"id": "CVE-2023-35152-342886e7",
"signature_version": "v1",
"digest": {
"line_hashes": [
"42596532390494141964913274341986790881",
"110724726295912202654593890427561008364",
"142324323199052876820229770819312990635"
],
"threshold": 0.9
}
},
{
"signature_type": "Line",
"target": {
"file": "xwiki-platform-core/xwiki-platform-like/xwiki-platform-like-api/src/main/java/org/xwiki/like/internal/DefaultLikeManager.java"
},
"deprecated": false,
"source": "https://github.com/xwiki/xwiki-platform/commit/0993a7ab3c102f9ac37ffe361a83a3dc302c0e45",
"id": "CVE-2023-35152-65cec367",
"signature_version": "v1",
"digest": {
"line_hashes": [
"153343030864296103107704987949784927826",
"61893200445043239388141735964627072893",
"216664644218393894236078578738037392099",
"133593028899533156655499655684677235518",
"245590790801850290475182552681953791888",
"175465543198553402312591616992349128726",
"236475409315313192995733105617029591251",
"40784972510516435168083725175066931579",
"279408143741698458516630925774249274486",
"29884500287803937506235308566091041521",
"220496415672285725809734828652601616425",
"19062969154866017586617074344660833477",
"329977159624647815885507365701932115997",
"205813689092821903462600102764524668769",
"109537427714201808122554174519018304433",
"287198507216424758845407703355001681406",
"38438586745246524914520709518613337072",
"283507447998242644937121982250089343504",
"213174757657204818957536484613150768491"
],
"threshold": 0.9
}
},
{
"signature_type": "Line",
"target": {
"file": "xwiki-platform-core/xwiki-platform-like/xwiki-platform-like-api/src/main/java/org/xwiki/like/LikeManager.java"
},
"deprecated": false,
"source": "https://github.com/xwiki/xwiki-platform/commit/0993a7ab3c102f9ac37ffe361a83a3dc302c0e45",
"id": "CVE-2023-35152-73257d93",
"signature_version": "v1",
"digest": {
"line_hashes": [
"245189121525260966262248970310143963203",
"245097187054742766657834439973421582310",
"57433205059129598294536086505201565139",
"159363660672494435621672375413529802392",
"85853456439833275472284682745008516785",
"268162827598562539263032627361623005424"
],
"threshold": 0.9
}
},
{
"signature_type": "Line",
"target": {
"file": "xwiki-platform-core/xwiki-platform-like/xwiki-platform-like-api/src/test/java/org/xwiki/like/script/LikeScriptServiceTest.java"
},
"deprecated": false,
"source": "https://github.com/xwiki/xwiki-platform/commit/0993a7ab3c102f9ac37ffe361a83a3dc302c0e45",
"id": "CVE-2023-35152-dcf3a1a7",
"signature_version": "v1",
"digest": {
"line_hashes": [
"280410508760815690942653365066069237837",
"37679175397079079891579535508326850852",
"333471091098568387051893414935360641182",
"296384556553637419951792533426535932281",
"326978057014718403445339297445322188496",
"338230266337898065118848058691866104307",
"2793220040292905920569248064424005715",
"116101382437245569514806631223163493061"
],
"threshold": 0.9
}
}
]
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-35152.json"