CVE-2023-26056: xwiki contains Incorrect Authorization
XWiki Platform is a generic wiki platform. Starting in version 3.0-milestone-1, it’s possible to execute a script with the right of another user, provided the target user does not have programming right. The problem has been patched in XWiki 14.8-rc-1, 14.4.5, and 13.10.10. There are no known workarounds for this issue.
References
- github.com/advisories/GHSA-859x-p6jp-rc2w
- github.com/xwiki/xwiki-platform/commit/4b75f212c2dd2dfc5fb5726c7830c6dbc9a425c6
- github.com/xwiki/xwiki-platform/commit/bd34ad6710ed72304304a3d5fec38b7cc050ef3b
- github.com/xwiki/xwiki-platform/commit/dd3f4735b41971b3afc3f3aedf6664b4e8be4894
- github.com/xwiki/xwiki-platform/security/advisories/GHSA-859x-p6jp-rc2w
- jira.xwiki.org/browse/XWIKI-19856
- nvd.nist.gov/vuln/detail/CVE-2023-26056
Code Behaviors & Features
Detect and mitigate CVE-2023-26056 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →