CVE-2023-32069: Incorrect Authorization

May 11, 2023

XWiki Platform is a generic wiki platform. Starting in version 3.3-milestone-2 and prior to versions 14.10.4 and 15.0-rc-1, it’s possible for a user to execute anything with the right of the author of the XWiki.ClassSheet document. This has been patched in XWiki 15.0-rc-1 and 14.10.4. There are no known workarounds.

References

github.com/advisories/GHSA-36fm-j33w-c25f
github.com/xwiki/xwiki-platform/commit/de72760d4a3e1e9be64a10660a0c19e9534e2ec4
github.com/xwiki/xwiki-platform/security/advisories/GHSA-36fm-j33w-c25f
jira.xwiki.org/browse/XWIKI-20566
nvd.nist.gov/vuln/detail/CVE-2023-32069

Code Behaviors & Features

Detect and mitigate CVE-2023-32069 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →