{"id":"CVE-2023-35152","aliases":["EUVD-2023-1877","GHSA-rf8j-q39g-7xfm"],"status":"published","title":"XWiki Platform vulnerable to privilege escalation (PR) from account through like LiveTableResults","description":"XWiki Platform is a generic wiki platform. Starting in version 12.9-rc-1 and prior to versions 14.4.8, 14.10.6, and 15.1, any logged in user can add dangerous content in their first name field and see it executed with programming rights. Leading to rights escalation. The vulnerability has been fixed on XWiki 14.4.8, 14.10.6, and 15.1. As a workaround, one may apply the patch manually.","severity":{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.01019,"percentile":0.63662,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-94","CWE-95"],"published":"2023-06-20T16:46:53Z","modified":"2026-10-28T10:38:55Z","fixes":[{"ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-like-ui","fixed_in":["14.4.8","14.10.6","15.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-like-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.9-rc-1"},{"fixed":"14.4.8"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-like-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14.5"},{"fixed":"14.10.6"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-like-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.0-rc-1"},{"fixed":"15.1"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-like-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.9-rc-1"},{"fixed":"14.4.8"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-like-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14.5"},{"fixed":"14.10.6"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-like-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.0-rc-1"},{"fixed":"15.1"}]}]}],"products":[{"vendor":"xwiki","product":"xwiki"},{"vendor":"xwiki","product":"xwiki-platform"}],"references":[{"url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-rf8j-q39g-7xfm","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://github.com/xwiki/xwiki-platform/commit/0993a7ab3c102f9ac37ffe361a83a3dc302c0e45#diff-0b51114cb27f7a5c599cf40c59d658eae6ddc5c0836532c3b35e163f40a4854fR39","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","fix","web"]},{"url":"https://github.com/xwiki/xwiki-platform/commit/6ce2d04a5779e07f6d3ed3f37d4761049b4fc3ac#diff-ef7f8b911bb8e584fda22aac5876a329add35ca0d1d32e0fdb62a439b78cfa49","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","fix","web"]},{"url":"https://jira.xwiki.org/browse/XWIKI-19900","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Vendor Advisory","web"]},{"url":"https://jira.xwiki.org/browse/XWIKI-20611","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-35152","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-rf8j-q39g-7xfm"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/35xxx/CVE-2023-35152.json","tags":["advisory"]},{"url":"https://github.com/xwiki/xwiki-platform","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2023-35152","title":"XWiki Platform vulnerable to privilege escalation (PR) from account through like LiveTableResults","description":"XWiki Platform is a generic wiki platform. Starting in version 12.9-rc-1 and prior to versions 14.4.8, 14.10.6, and 15.1, any logged in user can add dangerous content in their first name field and see it executed with programming rights. Leading to rights escalation. The vulnerability has been fixed on XWiki 14.4.8, 14.10.6, and 15.1. As a workaround, one may apply the patch manually.","status":"published","published":"2023-06-23T16:41:51.268Z","modified":"2024-11-27T20:45:47.82Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-95"],"updated_at":"2026-11-02T14:35:33.462059Z"}],"euvd":[{"id":"EUVD-2023-1877","description":"XWiki Platform is a generic wiki platform. Starting in version 12.9-rc-1 and prior to versions 14.4.8, 14.10.6, and 15.1, any logged in user can add dangerous content in their first name field and see it executed with programming rights. Leading to rights escalation. The vulnerability has been fixed on XWiki 14.4.8, 14.10.6, and 15.1. As a workaround, one may apply the patch manually.","status":"published","published":"2023-06-23T16:41:51Z","modified":"2024-11-27T20:45:47Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T00:04:45.257697Z"}],"ghsa":[{"id":"GHSA-rf8j-q39g-7xfm","title":"XWiki Platform vulnerable to privilege escalation (PR) from account through like LiveTableResults","description":"### Impact\nAny logged in user can add dangerous content in their first name field and see it executed with programming rights. Leading to rights escalation.\n\n### Patches\nThe vulnerability has been fixed on XWiki 14.4.8, 14.10.6, and 15.1.\n\n### Workarounds\nThe vulnerability can be fixed by applying this [patch](https://github.com/xwiki/xwiki-platform/commit/6ce2d04a5779e07f6d3ed3f37d4761049b4fc3ac#diff-ef7f8b911bb8e584fda22aac5876a329add35ca0d1d32e0fdb62a439b78cfa49).\n\nOn versions before 13.4-rc-1, the fix needs to be applied on [XWiki.Like.Code.LiveTableResultPage](https://github.com/xwiki/xwiki-platform/commit/0993a7ab3c102f9ac37ffe361a83a3dc302c0e45#diff-0b51114cb27f7a5c599cf40c59d658eae6ddc5c0836532c3b35e163f40a4854fR39).\n\n### References\n- The reported issue https://jira.xwiki.org/browse/XWIKI-20611, fixed by https://jira.xwiki.org/browse/XWIKI-19900\n- The patch https://github.com/xwiki/xwiki-platform/commit/6ce2d04a5779e07f6d3ed3f37d4761049b4fc3ac#diff-ef7f8b911bb8e584fda22aac5876a329add35ca0d1d32e0fdb62a439b78cfa49\n### For more information\n\nIf you have any questions or comments about this advisory:\n* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)\n* Email us at [Security Mailing List](mailto:security@xwiki.org)\n","status":"published","published":"2023-06-20T16:46:53Z","modified":"2023-11-12T05:03:48Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94","CWE-95"],"updated_at":"2026-11-02T14:37:21.209096Z"}],"nvd":[{"id":"CVE-2023-35152","description":"XWiki Platform is a generic wiki platform. Starting in version 12.9-rc-1 and prior to versions 14.4.8, 14.10.6, and 15.1, any logged in user can add dangerous content in their first name field and see it executed with programming rights. Leading to rights escalation. The vulnerability has been fixed on XWiki 14.4.8, 14.10.6, and 15.1. As a workaround, one may apply the patch manually.","status":"published","published":"2023-06-23T17:15:09.533Z","modified":"2026-06-17T06:04:30.307Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-95","CWE-94"],"updated_at":"2026-11-02T14:08:12.414559Z"}],"osv":[{"id":"CVE-2023-35152","title":"XWiki Platform vulnerable to privilege escalation (PR) from account through like LiveTableResults","description":"XWiki Platform is a generic wiki platform. Starting in version 12.9-rc-1 and prior to versions 14.4.8, 14.10.6, and 15.1, any logged in user can add dangerous content in their first name field and see it executed with programming rights. Leading to rights escalation. The vulnerability has been fixed on XWiki 14.4.8, 14.10.6, and 15.1. As a workaround, one may apply the patch manually.","status":"published","published":"2023-06-23T16:41:51.268Z","modified":"2026-10-28T10:38:55.853194374Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-95"],"updated_at":"2026-11-02T15:44:32.510144Z"},{"id":"GHSA-rf8j-q39g-7xfm","title":"XWiki Platform vulnerable to privilege escalation (PR) from account through like LiveTableResults","description":"### Impact\nAny logged in user can add dangerous content in their first name field and see it executed with programming rights. Leading to rights escalation.\n\n### Patches\nThe vulnerability has been fixed on XWiki 14.4.8, 14.10.6, and 15.1.\n\n### Workarounds\nThe vulnerability can be fixed by applying this [patch](https://github.com/xwiki/xwiki-platform/commit/6ce2d04a5779e07f6d3ed3f37d4761049b4fc3ac#diff-ef7f8b911bb8e584fda22aac5876a329add35ca0d1d32e0fdb62a439b78cfa49).\n\nOn versions before 13.4-rc-1, the fix needs to be applied on [XWiki.Like.Code.LiveTableResultPage](https://github.com/xwiki/xwiki-platform/commit/0993a7ab3c102f9ac37ffe361a83a3dc302c0e45#diff-0b51114cb27f7a5c599cf40c59d658eae6ddc5c0836532c3b35e163f40a4854fR39).\n\n### References\n- The reported issue https://jira.xwiki.org/browse/XWIKI-20611, fixed by https://jira.xwiki.org/browse/XWIKI-19900\n- The patch https://github.com/xwiki/xwiki-platform/commit/6ce2d04a5779e07f6d3ed3f37d4761049b4fc3ac#diff-ef7f8b911bb8e584fda22aac5876a329add35ca0d1d32e0fdb62a439b78cfa49\n### For more information\n\nIf you have any questions or comments about this advisory:\n* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)\n* Email us at [Security Mailing List](mailto:security@xwiki.org)\n","status":"published","published":"2023-06-20T16:46:53Z","modified":"2026-09-10T03:50:08.520547404Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94","CWE-95"],"updated_at":"2026-11-02T15:46:55.877614Z"}]}}