xwiki · xwiki-platform
A flaw in the annotation displayer of XWiki Platform (xwiki-platform) means that annotation content is not executed in a restricted context. An attacker who has a low-privilege account and can add annotations to a document can run code with the rights of that document's author, with no user interaction required.
XWiki Platform is a generic wiki platform. Starting in version 2.3-milestone-1, the annotation displayer does not execute the content in a restricted context. This allows executing anything with the right of the author of any document by annotating the document. This has been patched in XWiki 13.10.11, 14.4.7 and 14.10. There is no easy workaround except to upgrade.
Disclosed on 2 Mar 2023. No public exploit code or confirmed exploitation is recorded.
No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
1 package in 1 ecosystem. Main package: org.xwiki.platform:xwiki-platform-annotation-ui.
Upgrade to 14.10 or later
Set the version to 14.10 or later in your pom.xml or build.gradle.
The first fix for CVE-2023-26475. No other CVE tracked by Patchfirst affects this package.
| If you run | Upgrade to |
|---|---|
| 14.5 up to 14.10 | 14.10 |
| 14.0-rc-1 up to 14.4.7 | 14.4.7 |
| 2.3-milestone-1 up to 13.10.11 | 13.10.11 |
“Up to” means the second version is the fix and is not affected.