CVE-2023-26473

Published Mar 2, 2023

Last updated 2 years ago

Overview

Description: XWiki Platform is a generic wiki platform. Starting in version 1.3-rc-1, any user with edit right can execute arbitrary database select and access data stored in the database. The problem has been patched in XWiki 13.10.11, 14.4.7, and 14.10. There is no workaround for this vulnerability other than upgrading.
Source: security-advisories@github.com
NVD status: Analyzed

Hype score: Not currently trending

Risk scores

CVSS 3.1

Type: Primary
Base score: 6.5
Impact score: 3.6
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Severity: MEDIUM

Weaknesses

nvd@nist.gov: NVD-CWE-noinfo
security-advisories@github.com: CWE-284

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "81D871BF-1B0C-4673-A5C5-4B8E93F28F36",
            "versionEndExcluding": "13.10.11",
            "versionStartIncluding": "1.3"
          },
          {
            "criteria": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "FA3A5151-58FB-48CF-BFFB-5688608200C8",
            "versionEndExcluding": "14.4.7",
            "versionStartIncluding": "14.0"
          },
          {
            "criteria": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "569EE28C-5C86-467F-A153-DD4B9BF0053D",
            "versionEndExcluding": "14.10",
            "versionStartIncluding": "14.5"
          },
          {
            "criteria": "cpe:2.3:a:xwiki:xwiki:1.3:rc1:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "DA4524D3-0083-43A7-B398-6329A5781741"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Social media

Risk scores

CVSS 3.1

Weaknesses

Configurations

References