CVE-2023-35166

CriticalCVSS 9.9

Published: 20/06/2023(UTC)Updated: 17/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

60.57%

99th percentile - higher than 99% of all known CVEs

Summary

XWiki Platform is a generic wiki platform that allows executing any wiki content with the rights of the TipsPanel author by creating a tip UI extension. This issue has been patched in XWiki versions 15.1-rc-1 and 14.10.5.

Risk Assessment

Exploitation of this vulnerability could lead to unauthorized code execution in the context of the TipsPanel author's permissions, posing a significant security risk to applications built on XWiki.

Recommendation

It is recommended to upgrade to XWiki versions 15.1-rc-1 or 14.10.5 to mitigate this vulnerability.

Original NVD description (English source)

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to execute any wiki content with the right of the TipsPanel author by creating a tip UI extension. This has been patched in XWiki 15.1-rc-1 and 14.10.5.