org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability

NGHIÊM TRỌNG 9.8CVE-2023-26477 · GHSA-x2qm-r4wx-8gpg · Công bố 02/03/2023 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2023-26477 là lỗ hổng mức NGHIÊM TRỌNG (CVSS 9.8) ảnh hưởng org.xwiki.platform:xwiki-platform-flamingo-theme-ui, xwiki (xwiki).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 74.8%, cao hơn 99.5% các lỗ hổng khác.
Cách xử lý: cập nhật lên 14.4.6, 14.9-rc-1, 13.10.10, 14.9 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
org.xwiki.platform:xwiki-platform-flamingo-theme-ui Maven	`≥ 14.0, < 14.4.6≥ 14.5, < 14.9-rc-1≥ 6.2.4, < 13.10.10`	`14.4.614.9-rc-113.10.10`
xwiki xwiki	`≥ 14.0, < 14.4.6≥ 14.5, < 14.9≥ 6.2.4, < 13.10.10`	`14.4.614.913.10.10`

Mô tả

Impact

It's possible to inject arbitrary wiki syntax including Groovy, Python and Velocity script macros via the newThemeName request parameter (URL parameter), in combination with additional parameters form_token=1&action=create.

For instance: http://127.0.0.1:8080/xwiki/bin/view/FlamingoThemesCode/WebHomeSheet?newThemeName=foo%22%2F%7D%7D%7B%7Basync%20async%3D%22true%22%20cached%3D%22false%22%20context%3D%22doc.reference%22%7D%7D%7B%7Bgroovy%7D%7Dprintln(%22hello%20from%20groovy!%22)%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fasync%7D%7D&form_token=1&action=create will execute the following groovy code: println("hello from groovy!") on the server.

Patches

This has been patched in the supported versions 13.10.10, 14.9-rc-1, and 14.4.6.

Workarounds

It is possible to edit FlamingoThemesCode.WebHomeSheet and manually perform the changes from the patch fixing the issue.

References

For more information

If you have any questions or comments about this advisory:

Open an issue in Jira XWiki.org
Email us at Security Mailing List

Mô tả của NVD

XWiki Platform is a generic wiki platform. Starting in versions 6.3-rc-1 and 6.2.4, it's possible to inject arbitrary wiki syntax including Groovy, Python and Velocity script macros via the `newThemeName` request parameter (URL parameter), in combination with additional parameters. This has been patched in the supported versions 13.10.10, 14.9-rc-1, and 14.4.6. As a workaround, it is possible to edit `FlamingoThemesCode.WebHomeSheet` and manually perform the changes from the patch fixing the issue.