What’s Vulnerable › Vulnerabilities

CVE-2023-26473: XWiki Platform allows unprivileged users to make arbitrary select queries using DatabaseListProperty and suggest.vm

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-03-02 · updated 2026-06-17
• Weakness: CWE-284

Description

XWiki Platform is a generic wiki platform. Starting in version 1.3-rc-1, any user with edit right can execute arbitrary database select and access data stored in the database. The problem has been patched in XWiki 13.10.11, 14.4.7, and 14.10. There is no workaround for this vulnerability other than upgrading.

Affected products

• xwiki-platform: from 1.3 before 13.10.11; from 14.0 before 14.4.7; from 14.5 before 14.10; 1.3-rc1 — fixed in 13.10.11, 14.10, 14.4.7

How to fix

Upgrade to a fixed version: xwiki-platform 13.10.11, 14.10, 14.4.7. Check the vendor advisory for mitigations.

References

• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-vpx4-7rfp-h545
• https://jira.xwiki.org/browse/XWIKI-19523
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-vpx4-7rfp-h545
• https://jira.xwiki.org/browse/XWIKI-19523

Get alerted when CVE-2023-26473 or the next vulnerability affects your stack