CVE-2023-26473: XWiki Platform Web Arbitrary Select Queries Vulnerability
Summary
CVE-2023-26473: Impact Any user with edit right can execute arbitrary database select and access data stored in the database. Affects org.xwiki.platform:xwiki-platform-web across 3 version ranges.
>= 1.3-rc-1, < 13.10.11
>= 14.0, < 14.4.7
>= 14.5, < 14.10
Fixed in 13.10.11, 14.4.7 or 14.10, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
XWiki Platform Web is an open-source web application framework written in Java. It provides a platform for creating collaborative applications, such as wikis, blogs, and forums. The framework allows users to create and edit content, manage permissions, and perform various administrative tasks. However, a vulnerability has been discovered in XWiki Platform Web that allows unprivileged users to execute arbitrary database select queries, potentially exposing sensitive data stored in the database.
Vulnerability Detail
The vulnerability arises from the ability of unprivileged users to make arbitrary select queries using the DatabaseListProperty and suggest.vm components in XWiki Platform Web. By exploiting this vulnerability, any user with edit rights can execute database select queries and access data stored in the database. To reproduce the vulnerability, an attacker needs to create a new user without special privileges, create a page with restricted access rights, and then use the class editor to add a field with a malicious database select query. The attacker can then access the data by visiting a specific URL. This vulnerability has a CVSS score of 6.5, indicating a moderate severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 1.3-rc-1, < 13.10.1113.10.11 -
>= 14.0, < 14.4.714.4.7 -
>= 14.5, < 14.1014.10
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability other than upgrading to the patched versions of XWiki. It is crucial to apply the patches as soon as possible to mitigate the risk of unauthorized access to sensitive data.
Conclusion
The XWiki Platform Web Arbitrary Select Queries Vulnerability allows unprivileged users to execute arbitrary database select queries, potentially exposing sensitive data. It is crucial to upgrade to the patched versions of XWiki (13.10.11, 14.4.7, or 14.10) to mitigate the risk of unauthorized access. Regularly updating XWiki Platform Web is essential to ensure the latest security patches are applied. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.xwiki.platform:xwiki-platform-web →
FAQ
XWiki Platform Web is an open-source web application framework written in Java. It provides a platform for creating collaborative applications, such as wikis, blogs, and forums.
Any organization or individual using XWiki Platform Web versions prior to 13.10.11, 14.4.7, or 14.10 is potentially affected by this vulnerability.
An attacker can execute arbitrary database select queries and access sensitive data stored in the database. This can lead to unauthorized disclosure of confidential information.
There are no known public exploits for this vulnerability at the time of this advisory. However, it is important to apply the patches promptly to prevent any potential exploitation.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your XWiki installation is affected by this vulnerability. Simply enter your pom.xml file and the playground will analyze it for any known vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for org.xwiki.platform:xwiki-platform-web.
