XWiki <6.3,<6.2.4 Implicit Code Exec via newThemeName param (G/P/V)
CVE-2023-26477 Published on March 2, 2023
org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability
XWiki Platform is a generic wiki platform. Starting in versions 6.3-rc-1 and 6.2.4, it's possible to inject arbitrary wiki syntax including Groovy, Python and Velocity script macros via the `newThemeName` request parameter (URL parameter), in combination with additional parameters. This has been patched in the supported versions 13.10.10, 14.9-rc-1, and 14.4.6. As a workaround, it is possible to edit `FlamingoThemesCode.WebHomeSheet` and manually perform the changes from the patch fixing the issue.
Vulnerability Analysis
CVE-2023-26477 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be critical as this vulnerability has a high impact to the confidentiality, integrity and availability of this component.
Weakness Type
What is an Eval Injection Vulnerability?
The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval"). This may allow an attacker to execute arbitrary code, or at least modify what code can be executed.
CVE-2023-26477 has been classified to as an Eval Injection vulnerability or weakness.
Products Associated with CVE-2023-26477
Want to know whenever a new CVE is published for Xwiki? stack.watch will email you.
Affected Versions
xwiki-platform:- Version >= 6.2.4, < 13.10.10 is affected.
- Version >= 14.0, < 14.4.6 is affected.
- Version >= 14.5, < 14.9-rc-1 is affected.
Vulnerable Packages
The following package name and versions may be associated with CVE-2023-26477
| Package Manager | Vulnerable Package | Versions | Fixed In |
|---|---|---|---|
| maven | org.xwiki.platform:xwiki-platform-flamingo-theme-ui | >= 6.2.4, < 13.10.10 | 13.10.10 |
| maven | org.xwiki.platform:xwiki-platform-flamingo-theme-ui | >= 14.0, < 14.4.6 | 14.4.6 |
| maven | org.xwiki.platform:xwiki-platform-flamingo-theme-ui | >= 14.5, < 14.9-rc-1 | 14.9-rc-1 |
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.