CVE-2023-35166

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2023-35166
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-35166.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-35166
Aliases
Published
2023-06-20T19:29:51.912Z
Modified
2025-12-06T21:19:11.212304Z
Severity
  • 9.9 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
Summary
Privilege escalation (PR) from account through TipsPanel
Details

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to execute any wiki content with the right of the TipsPanel author by creating a tip UI extension. This has been patched in XWiki 15.1-rc-1 and 14.10.5.

Database specific 
{
    "cwe_ids": [
        "CWE-863"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/35xxx/CVE-2023-35166.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/xwiki/xwiki-commons

Affected ranges

Type
GIT
Repo
https://github.com/xwiki/xwiki-commons
Events
Introduced
6b0f407f00b668efda8e19aa41aee776f82dcd78
Fixed
8dfb9fcb4f456c70f82ea670ca0e2f3dee373ee4

Git / github.com/xwiki/xwiki-platform

Affected ranges

Type
GIT
Repo
https://github.com/xwiki/xwiki-platform
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
98208c5bb1e8cdf3ff1ac35d8b3d1cb3c28b3263

Affected versions

xwiki-application-calendar-1.*

xwiki-application-calendar-1.0

xwiki-platform-7.*

xwiki-platform-7.3-milestone-2
xwiki-platform-7.4-milestone-1
xwiki-platform-7.4-milestone-2

xwiki-platform-8.*

xwiki-platform-8.0-milestone-1
xwiki-platform-8.0-milestone-2
xwiki-platform-8.1-milestone-1
xwiki-platform-8.1-milestone-2
xwiki-platform-8.2-milestone-1
xwiki-platform-8.2-milestone-2
xwiki-platform-8.3-milestone-1

xwiki-platform-9.*

xwiki-platform-9.9-rc-2

xwiki-plugin-tag-1.*

xwiki-plugin-tag-1.1

Database specific

vanir_signatures

[
    {
        "signature_type": "Function",
        "source": "https://github.com/xwiki/xwiki-platform/commit/98208c5bb1e8cdf3ff1ac35d8b3d1cb3c28b3263",
        "deprecated": false,
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-test/xwiki-platform-test-ui/src/main/java/org/xwiki/test/ui/TestUtils.java",
            "function": "executeAndGetBodyAsString"
        },
        "id": "CVE-2023-35166-79b79c6d",
        "signature_version": "v1",
        "digest": {
            "function_hash": "14447729309296387817418829718357370229",
            "length": 225.0
        }
    },
    {
        "signature_type": "Line",
        "source": "https://github.com/xwiki/xwiki-platform/commit/98208c5bb1e8cdf3ff1ac35d8b3d1cb3c28b3263",
        "deprecated": false,
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-panels/xwiki-platform-panels-test/xwiki-platform-panels-test-pageobjects/src/main/java/org/xwiki/panels/test/po/PanelViewPage.java"
        },
        "id": "CVE-2023-35166-c823767c",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "25925747755441636746350101931272565222",
                "147219099890536987013760555543393223535",
                "333699726436675346995611010037943442162",
                "53947442270850455060094310709181132798",
                "301580855568517563688922281630698926591",
                "89042228836623502674888688411835274673",
                "296359591089317611326373224281631006506",
                "25974458481816779495127126247766411441"
            ]
        }
    },
    {
        "signature_type": "Function",
        "source": "https://github.com/xwiki/xwiki-platform/commit/98208c5bb1e8cdf3ff1ac35d8b3d1cb3c28b3263",
        "deprecated": false,
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-test/xwiki-platform-test-ui/src/main/java/org/xwiki/test/ui/TestUtils.java",
            "function": "toQueryString"
        },
        "id": "CVE-2023-35166-eac022cd",
        "signature_version": "v1",
        "digest": {
            "function_hash": "166246384768364013003536269361668174517",
            "length": 227.0
        }
    },
    {
        "signature_type": "Line",
        "source": "https://github.com/xwiki/xwiki-platform/commit/98208c5bb1e8cdf3ff1ac35d8b3d1cb3c28b3263",
        "deprecated": false,
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-test/xwiki-platform-test-ui/src/main/java/org/xwiki/test/ui/TestUtils.java"
        },
        "id": "CVE-2023-35166-f6b1fce3",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "266633864228528493549386452371347433207",
                "43735441723254684101747426884598112759",
                "47384835865222440417190816139285189514",
                "313878927082735046488116322325606766041",
                "122482562407068278039949829497503724801",
                "189707283566078500388873243356629685322",
                "6561773432538060453508578616831934461",
                "294454540879940323135238187662023702626",
                "48556899269463793951767124440096753382",
                "294680639907059971014533667933508619893",
                "292207954594304436987304925560526556172",
                "94739373799461362790737694673923578219",
                "303190057645613868296880879130810771082",
                "157893764397825346600080687898137392550",
                "125216989455414087892348001982983804144",
                "97732989549031072294872074751396201599",
                "203492244711342818278625656255727341325",
                "151873724696478795592841728622958662369",
                "134653291192210524618792979307894980066",
                "287501509234433704248035340288702479765",
                "202414337698643116640640628805582540639",
                "281216225390419403474826711798445416660"
            ]
        }
    }
]