CVE-2023-26475— XWiki Platform 安全漏洞
Possible ATT&CK Techniques 1AI
T1190 · Exploit Public-Facing Application新しい脆弱性情報の通知を購読するログインして購読
I. CVE-2023-26475の基本情報
脆弱性情報
脆弱性についてご質問がありますか？Shenlongの分析が参考になるかご確認ください！
Shenlongの10の質問を表示 ↗ 高度な大規模言語モデル技術を使用していますが、出力には不正確または古い情報が含まれる可能性があります。Shenlongはデータの正確性を確保するよう努めていますが、実際の状況に基づいて検証・判断してください。
脆弱性タイトル
XWiki Platform vulnerable to Remote Code Execution in Annotations
ソース: CVE Program / CVE List V5
脆弱性説明
XWiki Platform is a generic wiki platform. Starting in version 2.3-milestone-1, the annotation displayer does not execute the content in a restricted context. This allows executing anything with the right of the author of any document by annotating the document. This has been patched in XWiki 13.10.11, 14.4.7 and 14.10. There is no easy workaround except to upgrade.
ソース: CVE Program / CVE List V5
CVSS情報
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
ソース: CVE Program / CVE List V5
脆弱性タイプ
特权上下文切换错误
ソース: CVE Program / CVE List V5
脆弱性タイトル
XWiki Platform 安全漏洞
ソース: CNNVD (China National Vulnerability Database)
脆弱性説明
XWiki Platform是法国XWiki公司的一套用于创建Web协作应用程序的Wiki平台。 XWiki Platform存在安全漏洞，该漏洞源于允许通过注释文档以任何文档作者的权限执行任何操作。
ソース: CNNVD (China National Vulnerability Database)
CVSS情報
N/A
ソース: CNNVD (China National Vulnerability Database)
脆弱性タイプ
N/A
ソース: CNNVD (China National Vulnerability Database)
影響を受ける製品
| ベンダー | プロダクト | 影響を受けるバージョン | CPE | 購読 |
|---|---|---|---|---|
| xwiki | xwiki-platform | >= 2.3-milestone-1, < 13.10.11 | - |
II. CVE-2023-26475の公開POC
| # | POC説明 | ソースリンク | Shenlongリンク |
|---|
AI生成POCプレミアム
公開POCは見つかりませんでした。
ログインしてAI POCを生成III. CVE-2023-26475のインテリジェンス情報
请登录查看更多情报信息。
CVE-2023-26475 补丁与修复 (1)
CVE-2023-26475 厂商安全公告 (1)
CVE-2023-26475 其他参考 (2)
- https://jira.xwiki.org/browse/XWIKI-20384x_refsource_MISC
- https://jira.xwiki.org/browse/XWIKI-20360x_refsource_MISC
Same Patch Batch · xwiki · 2023-03-02 · 13 CVEs total
| CVE-2023-26055 | 10.0 CRITICAL | XWiki Commons may allow privilege escalation to programming rights via user's first name |
| CVE-2023-26471 | 10.0 CRITICAL | XWiki Platform users may execute anything with superadmin right through comments and async |
| CVE-2023-26472 | 10.0 CRITICAL | XWiki Platform vulnerable to privilege escalation via async macro and IconThemeSheet from |
| CVE-2023-26474 | 10.0 CRITICAL | XWiki Platform vulnerable to privilege escalation via properties with wiki syntax that are |
| CVE-2023-26477 | 10.0 CRITICAL | org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability |
| CVE-2023-26480 | 8.9 HIGH | XWiki-Platform vulnerable to stored Cross-site Scripting via the HTML displayer in Live Da |
| CVE-2023-26476 | 7.5 HIGH | Two XWiki Platform UIs Expose Sensitive Information to an Unauthorized Actor |
| CVE-2023-26478 | 6.6 MEDIUM | org.xwiki.platform:xwiki-platform-store-filesystem-oldcore has Exposed Dangerous Method or |
| CVE-2023-26473 | 6.5 MEDIUM | XWiki Platform allows unprivileged users to make arbitrary select queries using DatabaseLi |
| CVE-2023-26479 | 6.5 MEDIUM | org.xwiki.platform:xwiki-platform-rendering-parser vulnerable to Improper Handling of Exce |
| CVE-2023-26470 | 5.7 MEDIUM | In XWiki Platform, saving a document with a large object number leads to persistent OOM er |
| CVE-2023-26056 | 5.4 MEDIUM | XWiki Platform allows macro execution as any user without programming rights through the c |
IV. 関連脆弱性
同じ製品: xwiki-platform
- CVE-2026-48048
XWiki Platform's Livetable results still allow reconstructin - CVE-2026-48047
XWiki Platform vulnerable to potential arbitrary file writin - CVE-2026-33137
XWiki Platform has an Unauthenticated XAR Import via REST /w - CVE-2026-40105
XWiki has Reflected Cross-Site Scripting (XSS) in its page h - CVE-2026-33229
XWiki Platform affected by remote code execution with script
同じベンダー: xwiki
- CVE-2026-48048
XWiki Platform's Livetable results still allow reconstructin - CVE-2026-48047
XWiki Platform vulnerable to potential arbitrary file writin - CVE-2026-33137
XWiki Platform has an Unauthenticated XAR Import via REST /w - CVE-2026-23734
XWiki Platform: Path traversal via resources parameter in ss - CVE-2026-40105
XWiki has Reflected Cross-Site Scripting (XSS) in its page h
同じ弱点: CWE-270
- CVE-2026-34853
Huawei EMUI和Huawei HarmonyOS 安全漏洞 - CVE-2025-55210
FreePBX API has a Privilege Escalation Error in GraphQL Allo - CVE-2025-60721
Windows Administrator Protection Elevation of Privilege Vuln - CVE-2025-9408
Userspace privilege escalation vulnerability on Cortex M - CVE-2025-26499
Wind River Studio Developer 安全漏洞
V. CVE-2023-26475へのコメント
まだコメントはありません