XWiki Platform Async Macro RCE via Comments before v14.9
CVE-2023-26471 Published on March 2, 2023
XWiki Platform users may execute anything with superadmin right through comments and async macro
XWiki Platform is a generic wiki platform. Starting in version 11.6-rc-1, comments are supposed to be executed with the right of superadmin but in restricted mode (anything dangerous is disabled), but the async macro does not take into account the restricted mode. This means that any user with comment right can use the async macro to make it execute any wiki content with the right of superadmin. This has been patched in XWiki 14.9, 14.4.6, and 13.10.10. The only known workaround consists of applying a patch and rebuilding and redeploying `org.xwiki.platform:xwiki-platform-rendering-async-macro`.
Vulnerability Analysis
CVE-2023-26471 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be critical as this vulnerability has a high impact to the confidentiality, integrity and availability of this component.
Weakness Type
What is an Authorization Vulnerability?
The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CVE-2023-26471 has been classified to as an Authorization vulnerability or weakness.
Products Associated with CVE-2023-26471
Want to know whenever a new CVE is published for Xwiki? stack.watch will email you.
Affected Versions
xwiki-platform:- Version >= 11.6-rc-1, < 13.10.10 is affected.
- Version >= 14.0, < 14.4.6 is affected.
- Version >= 14.5, < 14.9 is affected.
Vulnerable Packages
The following package name and versions may be associated with CVE-2023-26471
| Package Manager | Vulnerable Package | Versions | Fixed In |
|---|---|---|---|
| maven | org.xwiki.platform:xwiki-platform-rendering-async-macro | >= 11.6-rc-1, < 13.10.10 | 13.10.10 |
| maven | org.xwiki.platform:xwiki-platform-rendering-async-macro | >= 14.0, < 14.4.6 | 14.4.6 |
| maven | org.xwiki.platform:xwiki-platform-rendering-async-macro | >= 14.5, < 14.9 | 14.9 |
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.