CVE-2023-26056: xwiki — Katalog CVE

csirt@kutim:~/threat-intel/cve/CVE-2023-26056

CVSS 5.4 · Medium EPSS 0,56%

Kerentanan Incorrect Authorization pada xwiki. Skor CVSS 3.1 5.4 (Medium) menurut NVD.

Deskripsi (NVD)

XWiki Platform is a generic wiki platform. Starting in version 3.0-milestone-1, it's possible to execute a script with the right of another user, provided the target user does not have programming right. The problem has been patched in XWiki 14.8-rc-1, 14.4.5, and 13.10.10. There are no known workarounds for this issue.

Rincian

Terbit di NVD: 2 Maret 2023
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 5.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-863: Incorrect Authorization
EPSS (30 hari): 0,56% peluang dieksploitasi; lebih tinggi dari 44,7% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
xwiki	xwiki	Versi 3.1 hingga sebelum 13.10.10
xwiki	xwiki	Versi 14.0 hingga sebelum 14.4.5
xwiki	xwiki	Versi 14.5 hingga sebelum 14.8
xwiki	xwiki	Versi 3.0 milestone1
xwiki	xwiki	Versi 3.0 milestone2
xwiki	xwiki	Versi 3.0 milestone3

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-859x-p6jp-rc2w exploit · advisory vendor
https://jira.xwiki.org/browse/XWIKI-19856 exploit · issue tracking · patch · advisory vendor
https://github.com/xwiki/xwiki-platform/commit/4b75f212c2dd2dfc5fb5726c7830c6dbc9a425c6 patch
https://github.com/xwiki/xwiki-platform/commit/bd34ad6710ed72304304a3d5fec38b7cc050ef3b patch
https://github.com/xwiki/xwiki-platform/commit/dd3f4735b41971b3afc3f3aedf6664b4e8be4894 patch

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.