XWiki CKEditor Peer Edit Rights Escalation & XSS (pre-14.10.6, pre-15.1)
CVE-2023-36477 Published on June 30, 2023

Persistent Cross-site Scripting (XSS) through CKEditor Configuration pages in XWiki Platform
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with edit rights can edit all pages in the `CKEditor' space. This makes it possible to perform a variety of harmful actions, such as removing technical documents, leading to loss of service and editing the javascript configuration of CKEditor, leading to persistent XSS. This issue has been patched in XWiki 14.10.6 and XWiki 15.1. This issue has been patched on the CKEditor Integration extension 1.64.9 for XWiki version older than 14.6RC1. Users are advised to upgrade. Users unable to upgrade may manually address the issue by restricting the `edit` and `delete` rights to a trusted user or group (e.g. the `XWiki.XWikiAdminGroup` group), implicitly disabling those rights for all other users. See commit `9d9d86179` for details.

Github Repository NVD

Vulnerability Analysis

CVE-2023-36477 can be exploited with network access, requires user interaction and a small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be critical as this vulnerability has a high impact to the confidentiality, integrity and availability of this component.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
LOW
User Interaction:
REQUIRED
Scope:
CHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
HIGH

Weakness Type

What is a XSS Vulnerability?

The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVE-2023-36477 has been classified to as a XSS vulnerability or weakness.


Products Associated with CVE-2023-36477

stack.watch emails you whenever new vulnerabilities are published in Xwiki or Xwiki Ckeditor Integration. Just hit a watch button to start following.

Xwiki
 
Xwiki Ckeditor Integration
 

Affected Versions

xwiki-platform:

Vulnerable Packages

The following package name and versions may be associated with CVE-2023-36477

Package Manager Vulnerable Package Versions Fixed In
maven org.xwiki.platform:xwiki-platform-ckeditor-ui >= 14.6-rc-1, < 14.10.6 14.10.6
maven org.xwiki.contrib:application-ckeditor-ui >= 1.9, < 1.64.9 1.64.9
maven org.xwiki.platform:xwiki-platform-ckeditor-ui >= 15.0-rc-1, < 15.1 15.1

Exploit Probability

EPSS
2.73%
Percentile
86.22%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.