CVE-2023-26473

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-26473
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-26473.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2023-26473
Aliases
Published
2023-03-02T18:17:09.152Z
Modified
2026-03-13T07:32:07.117162Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
XWiki Platform allows unprivileged users to make arbitrary select queries using DatabaseListProperty and suggest.vm
Details

XWiki Platform is a generic wiki platform. Starting in version 1.3-rc-1, any user with edit right can execute arbitrary database select and access data stored in the database. The problem has been patched in XWiki 13.10.11, 14.4.7, and 14.10. There is no workaround for this vulnerability other than upgrading.

Database specific 
{
    "cwe_ids": [
        "CWE-284"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/26xxx/CVE-2023-26473.json"
}
References

Affected packages

Git / github.com/xwiki/xwiki-platform

Affected ranges

Type
GIT
Repo
https://github.com/xwiki/xwiki-platform
Events
Introduced
d0986541d506c8c36c2fa2b0d2124d997844a8eb
Fixed
08e0887f0362b21614e6bfcb5be7e1f568659c41
Database specific 
{
    "versions": [
        {
            "introduced": "1.3-rc-1"
        },
        {
            "fixed": "13.10.11"
        }
    ]
}
Type
GIT
Repo
https://github.com/xwiki/xwiki-platform
Events
Introduced
d971304b0e0bf4f6dad278de89518edc17459741
Fixed
962ee4ac0352ab1a89cc779c29e81b0674d0203e
Database specific 
{
    "versions": [
        {
            "introduced": "14.0"
        },
        {
            "fixed": "14.4.7"
        }
    ]
}
Type
GIT
Repo
https://github.com/xwiki/xwiki-platform
Events
Introduced
ab4dfeaeef13360eebcaa507bc652073aa89a427
Fixed
c524887d154ff8f6df9651e36b904e234bf5a6ef
Database specific 
{
    "versions": [
        {
            "introduced": "14.5"
        },
        {
            "fixed": "14.10"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-26473.json"