CVE-2023-36477
CriticalCVSS 9.0Exploitation Probability (EPSS)
Elevated risk50th percentile - higher than 50% of all known CVEs
Summary
XWiki Platform allows users with edit rights to modify all pages in the `CKEditor` space, which can lead to the removal of technical documents and editing the JavaScript configuration of CKEditor, resulting in persistent XSS.
Risk Assessment
The organization may lose access to important documents and be exposed to XSS attacks, which can lead to data theft or takeover of applications.
Recommendation
It is recommended to upgrade to XWiki version 14.10.6 or 15.1 and CKEditor Integration extension 1.64.9. Users unable to upgrade should restrict edit and delete rights to trusted users or groups.
Original NVD description (English source)
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with edit rights can edit all pages in the `CKEditor' space. This makes it possible to perform a variety of harmful actions, such as removing technical documents, leading to loss of service and editing the javascript configuration of CKEditor, leading to persistent XSS. This issue has been patched in XWiki 14.10.6 and XWiki 15.1. This issue has been patched on the CKEditor Integration extension 1.64.9 for XWiki version older than 14.6RC1. Users are advised to upgrade. Users unable to upgrade may manually address the issue by restricting the `edit` and `delete` rights to a trusted user or group (e.g. the `XWiki.XWikiAdminGroup` group), implicitly disabling those rights for all other users. See commit `9d9d86179` for details.