CVE-2023-29507

Katalog CVE

CVSS 7.2 · High EPSS 0,90%

Kerentanan Incorrect Use of Privileged APIs pada xwiki. Skor CVSS 3.1 7.2 (High) menurut NVD.

Deskripsi (NVD)

XWiki Commons are technical libraries common to several other top level XWiki projects. The Document script API returns directly a DocumentAuthors allowing to set any authors to the document, which in consequence can allow subsequent executions of scripts since this author is used for checking rights. The problem has been patched in XWiki 14.10 and 14.4.7 by returning a safe script API.

Rincian

Terbit di NVD

16 April 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-648: Incorrect Use of Privileged APIs

EPSS (30 hari)

0,90% peluang dieksploitasi; lebih tinggi dari 58,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-pwfv-3cvg-9m4c advisory vendor
• https://github.com/xwiki/xwiki-platform/commit/905cdd7c421dbf8c565557cdc773ab1aa9028f83 patch
• https://jira.xwiki.org/browse/XWIKI-20380 issue tracking