CVE-2023-35152

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2023-35152
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-35152.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2023-35152
Aliases
Published
2023-06-23T16:41:51.268Z
Modified
2025-12-04T05:08:46.002065Z
Severity
  • 9.9 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
Summary
XWiki Platform vulnerable to privilege escalation (PR) from account through like LiveTableResults
Details

XWiki Platform is a generic wiki platform. Starting in version 12.9-rc-1 and prior to versions 14.4.8, 14.10.6, and 15.1, any logged in user can add dangerous content in their first name field and see it executed with programming rights. Leading to rights escalation. The vulnerability has been fixed on XWiki 14.4.8, 14.10.6, and 15.1. As a workaround, one may apply the patch manually.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/35xxx/CVE-2023-35152.json",
    "cwe_ids": [
        "CWE-95"
    ]
}
References

Affected packages

Git / github.com/xwiki/xwiki-platform

Affected ranges

Type
GIT
Repo
https://github.com/xwiki/xwiki-platform
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
0993a7ab3c102f9ac37ffe361a83a3dc302c0e45
Fixed
6ce2d04a5779e07f6d3ed3f37d4761049b4fc3ac

Affected versions

xwiki-application-calendar-1.*

xwiki-application-calendar-1.0

xwiki-platform-7.*

xwiki-platform-7.3-milestone-2
xwiki-platform-7.4-milestone-1
xwiki-platform-7.4-milestone-2

xwiki-platform-8.*

xwiki-platform-8.0-milestone-1
xwiki-platform-8.0-milestone-2
xwiki-platform-8.1-milestone-1
xwiki-platform-8.1-milestone-2
xwiki-platform-8.2-milestone-1
xwiki-platform-8.2-milestone-2
xwiki-platform-8.3-milestone-1

xwiki-platform-9.*

xwiki-platform-9.9-rc-2

xwiki-plugin-tag-1.*

xwiki-plugin-tag-1.1

Database specific

vanir_signatures

[
    {
        "source": "https://github.com/xwiki/xwiki-platform/commit/0993a7ab3c102f9ac37ffe361a83a3dc302c0e45",
        "id": "CVE-2023-35152-002459f5",
        "digest": {
            "function_hash": "108013058048315318989389995389115188975",
            "length": 57.0
        },
        "deprecated": false,
        "signature_type": "Function",
        "target": {
            "function": "dispose",
            "file": "xwiki-platform-core/xwiki-platform-like/xwiki-platform-like-api/src/main/java/org/xwiki/like/internal/DefaultLikeManager.java"
        },
        "signature_version": "v1"
    },
    {
        "source": "https://github.com/xwiki/xwiki-platform/commit/0993a7ab3c102f9ac37ffe361a83a3dc302c0e45",
        "id": "CVE-2023-35152-14d4562e",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "78092718867657142493592034427816036413",
                "3583382527629898726239598230472055319"
            ]
        },
        "deprecated": false,
        "signature_type": "Line",
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-like/xwiki-platform-like-api/src/test/java/org/xwiki/like/internal/DefaultLikeManagerTest.java"
        },
        "signature_version": "v1"
    },
    {
        "source": "https://github.com/xwiki/xwiki-platform/commit/0993a7ab3c102f9ac37ffe361a83a3dc302c0e45",
        "id": "CVE-2023-35152-342886e7",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "42596532390494141964913274341986790881",
                "110724726295912202654593890427561008364",
                "142324323199052876820229770819312990635"
            ]
        },
        "deprecated": false,
        "signature_type": "Line",
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-like/xwiki-platform-like-api/src/main/java/org/xwiki/like/script/LikeScriptService.java"
        },
        "signature_version": "v1"
    },
    {
        "source": "https://github.com/xwiki/xwiki-platform/commit/0993a7ab3c102f9ac37ffe361a83a3dc302c0e45",
        "id": "CVE-2023-35152-65cec367",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "153343030864296103107704987949784927826",
                "61893200445043239388141735964627072893",
                "216664644218393894236078578738037392099",
                "133593028899533156655499655684677235518",
                "245590790801850290475182552681953791888",
                "175465543198553402312591616992349128726",
                "236475409315313192995733105617029591251",
                "40784972510516435168083725175066931579",
                "279408143741698458516630925774249274486",
                "29884500287803937506235308566091041521",
                "220496415672285725809734828652601616425",
                "19062969154866017586617074344660833477",
                "329977159624647815885507365701932115997",
                "205813689092821903462600102764524668769",
                "109537427714201808122554174519018304433",
                "287198507216424758845407703355001681406",
                "38438586745246524914520709518613337072",
                "283507447998242644937121982250089343504",
                "213174757657204818957536484613150768491"
            ]
        },
        "deprecated": false,
        "signature_type": "Line",
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-like/xwiki-platform-like-api/src/main/java/org/xwiki/like/internal/DefaultLikeManager.java"
        },
        "signature_version": "v1"
    },
    {
        "source": "https://github.com/xwiki/xwiki-platform/commit/0993a7ab3c102f9ac37ffe361a83a3dc302c0e45",
        "id": "CVE-2023-35152-73257d93",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "245189121525260966262248970310143963203",
                "245097187054742766657834439973421582310",
                "57433205059129598294536086505201565139",
                "159363660672494435621672375413529802392",
                "85853456439833275472284682745008516785",
                "268162827598562539263032627361623005424"
            ]
        },
        "deprecated": false,
        "signature_type": "Line",
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-like/xwiki-platform-like-api/src/main/java/org/xwiki/like/LikeManager.java"
        },
        "signature_version": "v1"
    },
    {
        "source": "https://github.com/xwiki/xwiki-platform/commit/0993a7ab3c102f9ac37ffe361a83a3dc302c0e45",
        "id": "CVE-2023-35152-dcf3a1a7",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "280410508760815690942653365066069237837",
                "37679175397079079891579535508326850852",
                "333471091098568387051893414935360641182",
                "296384556553637419951792533426535932281",
                "326978057014718403445339297445322188496",
                "338230266337898065118848058691866104307",
                "2793220040292905920569248064424005715",
                "116101382437245569514806631223163493061"
            ]
        },
        "deprecated": false,
        "signature_type": "Line",
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-like/xwiki-platform-like-api/src/test/java/org/xwiki/like/script/LikeScriptServiceTest.java"
        },
        "signature_version": "v1"
    }
]

Git / github.com/xwiki/xwiki-commons

Affected ranges

Type
GIT
Repo
https://github.com/xwiki/xwiki-commons
Events
Introduced
0b0c139434b6adb4aafd3487ab4def4920f7edef
Fixed
48ee3193230753aecf8a86d7c8ff3e8f869e8330