CVE-2023-29507
The Document script API returns directly a DocumentAuthors allowing to set any authors to the document, which in consequence can allow subsequent executions of scripts since this author is used for checking rights.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.90%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
XWiki Commons are technical libraries common to several other top level XWiki projects. The Document script API returns directly a DocumentAuthors allowing to set any authors to the document, which in consequence can allow subsequent executions of scripts since this author is used for checking rights. The problem has been patched in XWiki 14.10 and 14.4.7 by returning a safe script API.
- CVSS 3.1
- 7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.90% probability · 58th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-648
- Affected
- xwiki/xwiki
- Source
- security-advisories@github.com
References
- https://github.com/xwiki/xwiki-platform/commit/905cdd7c421dbf8c565557cdc773ab1aa9028f83Patch
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-pwfv-3cvg-9m4cVendor Advisory
- https://jira.xwiki.org/browse/XWIKI-20380Issue Tracking
- https://github.com/xwiki/xwiki-platform/commit/905cdd7c421dbf8c565557cdc773ab1aa9028f83Patch
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-pwfv-3cvg-9m4cVendor Advisory
- https://jira.xwiki.org/browse/XWIKI-20380Issue Tracking
- https://jira.xwiki.org/browse/XWIKI-20380Issue Tracking
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.