Back to overview

CVE-2023-35166

CRITICAL
10.0
CVSS 3.1
Description
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to execute any wiki content with the right of the TipsPanel author by creating a tip UI extension. This has been patched in XWiki 15.1-rc-1 and 14.10.5.

Metadata

CVE ID
CVE-2023-35166
State
PUBLISHED
Assigner
GitHub_M
Reserved
2023-06-14 14:17 UTC
Published
2023-06-20 19:29 UTC
Last updated
2024-12-06 21:35 UTC
Primary CWE
CWE-863
CWE-863: Incorrect Authorization
Vendor / Product
xwiki / xwiki-platform
Sources
cve.org  ·  NVD

Severity & Metrics

10.0 CRITICAL CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
SSVC — CISA Coordinator
Exploitation
none
Automatable
no
Tech. Impact
total
Affected products (1)
VendorProductPlatformVersions
xwiki xwiki-platform — >= 8.1-milestone-1, < 14.10.5, >= 15.0-rc-1, < 15.1-rc-1
Weakness (CWE)
CWESourceDescription
CWE-863 cna CWE-863: Incorrect Authorization
CVSS scores (1)
ScoreSeverityVersionSourceVector
10.0 CRITICAL 3.1 cna CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
References (3)
Back to overview