CVE-2023-26055

Katalog CVE

CVSS 9.9 · Critical EPSS 1,2%

Kerentanan Improper Neutralization of Escape, Meta, or Control Sequences pada xwiki commons. Skor CVSS 3.1 9.9 (Critical) menurut NVD.

Deskripsi (NVD)

XWiki Commons are technical libraries common to several other top level XWiki projects. Starting in version 3.1-milestone-1, any user can edit their own profile and inject code, which is going to be executed with programming right. The same vulnerability can also be exploited in all other places where short text properties are displayed, e.g., in apps created using Apps Within Minutes that use a short text field. The problem has been patched on versions 13.10.9, 14.4.4, 14.7RC1.

Rincian

Terbit di NVD

2 Maret 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.9 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences

EPSS (30 hari)

1,2% peluang dieksploitasi; lebih tinggi dari 66,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/xwiki/xwiki-commons/security/advisories/GHSA-8cw6-4r32-6r3h exploit · advisory vendor
• https://jira.xwiki.org/browse/XCOMMONS-2498 issue tracking · patch · advisory vendor
• https://jira.xwiki.org/browse/XWIKI-19793 exploit · issue tracking · patch · advisory vendor
• https://jira.xwiki.org/browse/XWIKI-19794 exploit · issue tracking · patch · advisory vendor