CRITICAL🇵🇱 Wersja polska

CVE-2023-26055

CVSS 9.9v3.1pub. 2023-03-02upd. 2024-11-21

XWiki Commons are technical libraries common to several other top level XWiki projects. Starting in version 3.1-milestone-1, any user can edit their own profile and inject code, which is going to be executed with programming right. The same vulnerability can also be exploited in all other places where short text properties are displayed, e.g., in apps created using Apps Within Minutes that use a short text field. The problem has been patched on versions 13.10.9, 14.4.4, 14.7RC1.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

  • Xwiki Commons

    APP
    Xwiki
    14.43.13.1.13.2 – 13.10.9 (excl.)14.4 – 14.4.4 (excl.)14.5 – 14.7 (excl.)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2023-36471CRITICAL9.0PL ✓same product

XWiki Commons: RCE i XSS przez niedostateczną sanityzację HTML (form/input)

CVE-2023-29528CRITICAL9.0PL ✓same product

XWiki Commons: XSS przez nieprawidłowe komentarze HTML prowadzący do RCE

CVE-2022-24898MEDIUM4.9same product

org.xwiki.commons:xwiki-commons-xml is a common module used by other XWiki top level projects. Starting in ver...

CVE-2025-24893CRITICAL9.8⚠ KEVPL ✓same vendor

XWiki Platform — niezautoryzowany RCE przez endpoint SolrSearch

CVE-2025-65091CRITICAL10.0PL ✓same vendor

SQL Injection w XWiki Full Calendar Macro — dostęp bez uwierzytelnienia