XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with edit rights can edit all pages in the `CKEditor' space. This makes it possible to perform a variety of harmful actions, such as removing technical documents, leading to loss of service and editing the javascript configuration of CKEditor, leading to persistent XSS. This issue has been patched in XWiki 14.10.6 and XWiki 15.1. This issue has been patched on the CKEditor Integration extension 1.64.9 for XWiki version older than 14.6RC1. Users are advised to upgrade. Users unable to upgrade may manually address the issue by restricting the `edit` and `delete` rights to a trusted user or group (e.g. the `XWiki.XWikiAdminGroup` group), implicitly disabling those rights for all other users. See commit `9d9d86179` for details.
References
| Link | Resource |
|---|---|
| https://github.com/xwiki/xwiki-platform/commit/9d9d86179457cb8dc48b4491510537878800be4f | Patch |
| https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-793w-g325-hrw2 | Exploit Mitigation Patch Vendor Advisory |
| https://jira.xwiki.org/browse/CKEDITOR-508 | Exploit Issue Tracking Vendor Advisory |
| https://jira.xwiki.org/browse/XWIKI-20590 | Exploit Issue Tracking Vendor Advisory |
| https://github.com/xwiki/xwiki-platform/commit/9d9d86179457cb8dc48b4491510537878800be4f | Patch |
| https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-793w-g325-hrw2 | Exploit Mitigation Patch Vendor Advisory |
| https://jira.xwiki.org/browse/CKEDITOR-508 | Exploit Issue Tracking Vendor Advisory |
| https://jira.xwiki.org/browse/XWIKI-20590 | Exploit Issue Tracking Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 08:09
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.0 |
| References | () https://github.com/xwiki/xwiki-platform/commit/9d9d86179457cb8dc48b4491510537878800be4f - Patch | |
| References | () https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-793w-g325-hrw2 - Exploit, Mitigation, Patch, Vendor Advisory | |
| References | () https://jira.xwiki.org/browse/CKEDITOR-508 - Exploit, Issue Tracking, Vendor Advisory | |
| References | () https://jira.xwiki.org/browse/XWIKI-20590 - Exploit, Issue Tracking, Vendor Advisory |
10 Jul 2023, 16:38
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.4 |
| References | (MISC) https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-793w-g325-hrw2 - Exploit, Mitigation, Patch, Vendor Advisory | |
| References | (MISC) https://jira.xwiki.org/browse/XWIKI-20590 - Exploit, Issue Tracking, Vendor Advisory | |
| References | (MISC) https://jira.xwiki.org/browse/CKEDITOR-508 - Exploit, Issue Tracking, Vendor Advisory | |
| References | (MISC) https://github.com/xwiki/xwiki-platform/commit/9d9d86179457cb8dc48b4491510537878800be4f - Patch | |
| First Time |
Xwiki
Xwiki ckeditor Integration Xwiki xwiki |
|
| CPE | cpe:2.3:a:xwiki:xwiki:15.0:rc1:*:*:*:*:*:* cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:* cpe:2.3:a:xwiki:ckeditor_integration:*:*:*:*:*:xwiki:*:* cpe:2.3:a:xwiki:xwiki:15.0:-:*:*:*:*:*:* |
30 Jun 2023, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-06-30 19:15
Updated : 2024-11-21 08:09
NVD link : CVE-2023-36477
Mitre link : CVE-2023-36477
CVE.ORG link : CVE-2023-36477
JSON object : View
Products Affected
xwiki
- xwiki
- ckeditor_integration
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')