CVE-2023-26472: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

March 3, 2023

XWiki Platform is a generic wiki platform. Starting in version 6.2-milestone-1, one can execute any wiki content with the right of IconThemeSheet author by creating an icon theme with certain content. This can be done by creating a new page or even through the user profile for users not having edit right. The issue has been patched in XWiki 14.9, 14.4.6, and 13.10.10. An available workaround is to fix the bug in the page IconThemesCode.IconThemeSheet by applying a modification from commit 48caf7491595238af2b531026a614221d5d61f38.

References

github.com/advisories/GHSA-vwr6-qp4q-2wj7
github.com/xwiki/xwiki-platform/commit/48caf7491595238af2b531026a614221d5d61f38
github.com/xwiki/xwiki-platform/security/advisories/GHSA-vwr6-qp4q-2wj7
jira.xwiki.org/browse/XWIKI-19731
nvd.nist.gov/vuln/detail/CVE-2023-26472

Code Behaviors & Features

Detect and mitigate CVE-2023-26472 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →