CVE-2023-26471 json
XWiki Platform users may execute anything with superadmin right through comments and async macro
published 2023-03-02 3 y ago modified 2026-06-17 4 mo ago also GHSA-9cqm-5wf7-wcj7 , EUVD-2023-0963
- cvss
- 10.0
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.9%
- EPSS 0.9% chance of exploitation in 30 days, percentile 60%
- public exploits
- 0
- none known
Summary
XWiki Platform is a generic wiki platform. Starting in version 11.6-rc-1, comments are supposed to be executed with the right of superadmin but in restricted mode (anything dangerous is disabled), but the async macro does not take into account the restricted mode. This means that any user with comment right can use the async macro to make it execute any wiki content with the right of superadmin. This has been patched in XWiki 14.9, 14.4.6, and 13.10.10. The only known workaround consists of applying a patch and rebuilding and redeploying `org.xwiki.platform:xwiki-platform-rendering-async-macro`.
Patch / fix
- maven org.xwiki.platform:xwiki-platform-rendering-async-macro 13.10.10, 14.4.6, 14.9
- xwiki xwiki 13.10.10, 14.4.6, 14.9
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 20 mo ago
Exploit prediction
0.92% chance of exploitation in the next 30 days, higher than 60% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- jira.xwiki.org https://jira.xwiki.org/browse/XWIKI-20234 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 10.0 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
| NVD | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 9.9 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.xwiki.platform:xwiki-platform-rendering-async-macro | >=11.6-rc-1, <13.10.10 >=14.0, <14.4.6 >=14.5, <14.9 |
13.10.10 14.4.6 14.9 |
Affected products
- xwiki xwiki-platform
Classification
- Weakness
-
- CWE-284 Improper Access Control
References
-
github.com
/xwiki/xwiki-platform/commit/00532d9f1404287cf3ec3a05056640d809516006
web, patch
-
jira.xwiki.org
/browse/XWIKI-20234
web, exploit, issue-tracking, patch, vendor-advisory
-
github.com
/xwiki/xwiki-platform/security/advisories/GHSA-9cqm-5wf7-wcj7
web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2023-26471
advisory
-
github.com
/xwiki/xwiki-platform
package
Sources
- CVE List CVE-2023-26471
- GitHub Advisory GHSA-9cqm-5wf7-wcj7
- NVD CVE-2023-26471
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.