CVE-2023-27480: Improper Restriction of XML External Entity Reference

March 8, 2023

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with edit rights on a document can trigger an XAR import on a forged XAR file, leading to the ability to display the content of any file on the XWiki server host. This vulnerability has been patched in XWiki 13.10.11, 14.4.7 and 14.10-rc-1. Users are advised to upgrade. Users unable to upgrade may apply the patch e3527b98fd manually.

References

github.com/advisories/GHSA-gx4f-976g-7g6v
github.com/xwiki/xwiki-platform/commit/e3527b98fdd8dc8179c24dc55e662b2c55199434
github.com/xwiki/xwiki-platform/security/advisories/GHSA-gx4f-976g-7g6v
jira.xwiki.org/browse/XWIKI-20320
nvd.nist.gov/vuln/detail/CVE-2023-27480

Code Behaviors & Features

Detect and mitigate CVE-2023-27480 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →