CVE-2023-26472

🎯 CVE-2023-26472 🧪 PoC 🇪🇺 EUVD

💬 0 Diskussion 📄 .md Alle CVEs anzeigen ✕

CVE-2023-26472 | XWiki Platform is a generic wiki platform. Starting in version 6.2-milestone-1, one can execute any wiki content with the right of IconThemeSheet author by creating an icon theme with certain content. This can be done by creating a new page or even through the user profile for users not having edit right. The issue has been patched in XWiki 14.9, 14.4.6, and 13.10.10. An available workaround is to fix the bug in the page `IconThemesCode.IconThemeSheet` by app

XWiki Platform is a generic wiki platform. Starting in version 6.2-milestone-1, one can execute any wiki content with the right of IconThemeSheet author by creating an icon theme with certain content. This can be done by creating a new page or even through the user profile for users not having edit right. The issue has been patched in XWiki 14.9, 14.4.6, and 13.10.10. An available workaround is to fix the bug in the page `IconThemesCode.IconThemeSheet` by applying a modification from commit 48caf7491595238af2b531026a614221d5d61f38.

Klassifikation & Betroffenheit:

CWE-116 xwiki xwiki-platform 14.5, < 14.9xwiki-platform 6.2-milestone-1, < 13.10.10xwiki-platform 14.0, < 14.4.6xwiki xwiki *xwiki xwiki 6.2

Improper Encoding or Escaping of Output 🎯 High

The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

🛡️ Empfohlene Mitigation: Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, consider using the ESAPI Encoding control [REF-45] or a similar tool, library, or framework. These will help the programmer encode outputs in a manner less prone to e…

Vollständige Definition bei MITRE ➔

⚔️ Typische Angriffsmuster (CAPEC):

CAPEC-73 · User-Controlled Filename (High) CAPEC-81 · Web Server Logs Tampering (High) CAPEC-85 · AJAX Footprinting (Low) CAPEC-104 · Cross Zone Scripting (High)

🧩 Ähnliche Schwachstellen (Hersteller/Klasse/Score-Band):

CVE-2025-55730 10.0 CVE-2025-55729 10.0 CVE-2025-53836 10.0 CVE-2025-49013 10.0 CVE-2024-55877 10.0

🩹 Patch verfügbar (OSV):

🩹 bc18e50bcf9ea40d1e25ff8d065b3178c8247f16 🩹 61952343490e97926364658196c63936e0b384c5

📚 Referenzen & Quellen:

🇪🇺 Original-Eintrag (ENISA EUVD) 🇺🇸 NVD-Eintrag

Ausnutzungs-Zeitleiste:

Reserviert 2023

Veröffentlicht 03/2023

Heute 08.11.

CVSS-Vektor-Analyse: 10.0

AV · Angriffsvektor Netzwerk

AC · Komplexität Gering

PR · Privilegien Gering

UI · Interaktion Keine

S · Scope Verändert

C · Vertraulichkeit Hoch

I · Integrität Hoch

A · Verfügbarkeit Hoch

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CNA-Bewertung (GitHub_M): 10.0 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Veröffentlicht:02.03.2023

Aktualisiert:17.06.2026 05:43

Assigner (CNA):GitHub_M

EUVD-ID:EUVD-2023-1122

Quellen: 🇪🇺 EUVD-Datenbank (ENISA) + 🇺🇸 NVD-Anreicherung · 24-h-Cache

CWE-116 ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Sicherheits-Update des Herstellers zeitnah einspielen und Netzwerksegmentierung prüfen.

Tier	CVEs	Anteil
≥90 %	785	0,2 %
≥50 %	3.559	0,9 %
≥10 %	13.139	3,2 %
<10 %	396.072	95,8 %

Tier

CVEs

Anteil

≥90 %

785

0,2 %

≥50 %

3.559

0,9 %

≥10 %

13.139

3,2 %

<10 %

396.072

95,8 %

10.0 CRITICAL

EPSS

1.1%

CVE-2023-26472 🌐 Netzwerk (Remote) 🔑 Geringe Nutzerrechte nötig

xwiki

CVE-2023-26472 | XWiki Platform is a generic wiki platform. Starting in version 6.2-milestone-1, one can execute any wiki content with the right of IconThemeSheet author by creating an icon theme with certain content. This can be done by creating a new page or even through the user profile for users not having edit right. The issue has been patched in XWiki 14.9, 14.4.6, and 13.10.10. An available workaround is to fix the bug in the page `IconThemesCode.IconThemeSheet` by app

CWE-116 ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Sicherheits-Update des Herstellers zeitnah einspielen und Netzwerksegmentierung prüfen.

vor 3 Jahren ↻ vor 1 Jahr

🛡️ Details ➔

Zero-Day & Vulnerability Intelligence Hub