GHSA-rf8j-q39g-7xfm

Source

https://github.com/advisories/GHSA-rf8j-q39g-7xfm

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/06/GHSA-rf8j-q39g-7xfm/GHSA-rf8j-q39g-7xfm.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-rf8j-q39g-7xfm

Aliases

CVE-2023-35152

Published

2023-06-20T16:46:53Z

Modified

2026-09-10T03:50:08Z

Severity

9.9 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVSS Calculator

Summary

XWiki Platform vulnerable to privilege escalation (PR) from account through like LiveTableResults

Details

Impact

Any logged in user can add dangerous content in their first name field and see it executed with programming rights. Leading to rights escalation.

Patches

The vulnerability has been fixed on XWiki 14.4.8, 14.10.6, and 15.1.

Workarounds

The vulnerability can be fixed by applying this patch.

On versions before 13.4-rc-1, the fix needs to be applied on XWiki.Like.Code.LiveTableResultPage.

References

For more information

If you have any questions or comments about this advisory:

Open an issue in Jira XWiki.org
Email us at Security Mailing List

Database specific

{
    "cwe_ids":  [
        "CWE-94",
        "CWE-95"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2023-06-20T16:46:53Z",
    "nvd_published_at":  "2023-06-23T17:15:09Z",
    "severity":  "CRITICAL"
}

References

Affected packages

Maven

org.xwiki.platform:xwiki-platform-like-ui

Package

Name: org.xwiki.platform:xwiki-platform-like-ui; View open source insights on deps.dev
Purl: pkg:maven/org.xwiki.platform/xwiki-platform-like-ui

Affected ranges

Type: ECOSYSTEM
Events: Introduced

12.9-rc-1

Fixed

14.4.8

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/06/GHSA-rf8j-q39g-7xfm/GHSA-rf8j-q39g-7xfm.json"

org.xwiki.platform:xwiki-platform-like-ui

Package

Name: org.xwiki.platform:xwiki-platform-like-ui; View open source insights on deps.dev
Purl: pkg:maven/org.xwiki.platform/xwiki-platform-like-ui

Affected ranges

Type: ECOSYSTEM
Events: Introduced

14.5

Fixed

14.10.6

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/06/GHSA-rf8j-q39g-7xfm/GHSA-rf8j-q39g-7xfm.json"

org.xwiki.platform:xwiki-platform-like-ui

Package

Name: org.xwiki.platform:xwiki-platform-like-ui; View open source insights on deps.dev
Purl: pkg:maven/org.xwiki.platform/xwiki-platform-like-ui

Affected ranges

Type: ECOSYSTEM
Events: Introduced

15.0-rc-1

Fixed

15.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/06/GHSA-rf8j-q39g-7xfm/GHSA-rf8j-q39g-7xfm.json"