{"id":"CVE-2023-35152","summary":"XWiki Platform vulnerable to privilege escalation (PR) from account through like LiveTableResults","details":"XWiki Platform is a generic wiki platform. Starting in version 12.9-rc-1 and prior to versions 14.4.8, 14.10.6, and 15.1, any logged in user can add dangerous content in their first name field and see it executed with programming rights. Leading to rights escalation. The vulnerability has been fixed on XWiki 14.4.8, 14.10.6, and 15.1. As a workaround, one may apply the patch manually.","aliases":["GHSA-rf8j-q39g-7xfm"],"modified":"2026-08-12T14:51:05.803458Z","published":"2023-06-23T16:41:51.268Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-95"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/35xxx/CVE-2023-35152.json"},"references":[{"type":"WEB","url":"https://jira.xwiki.org/browse/XWIKI-19900"},{"type":"WEB","url":"https://jira.xwiki.org/browse/XWIKI-20611"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/35xxx/CVE-2023-35152.json"},{"type":"ADVISORY","url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-rf8j-q39g-7xfm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-35152"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/0993a7ab3c102f9ac37ffe361a83a3dc302c0e45#diff-0b51114cb27f7a5c599cf40c59d658eae6ddc5c0836532c3b35e163f40a4854fR39"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/6ce2d04a5779e07f6d3ed3f37d4761049b4fc3ac#diff-ef7f8b911bb8e584fda22aac5876a329add35ca0d1d32e0fdb62a439b78cfa49"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/xwiki/xwiki-commons","events":[{"introduced":"0b0c139434b6adb4aafd3487ab4def4920f7edef"},{"fixed":"48ee3193230753aecf8a86d7c8ff3e8f869e8330"},{"introduced":"719ede2f8510fa69498761659de8d65eec5817db"},{"fixed":"f0645cf53274e7ef6c17285a079673573c4e41c2"},{"introduced":"fdba4ca1398766e912f7888af5bdefbeef60d8b0"},{"last_affected":"fdba4ca1398766e912f7888af5bdefbeef60d8b0"}],"database_specific":{"extracted_events":[{"introduced":"12.9"},{"fixed":"14.4.8"},{"introduced":"14.10"},{"fixed":"14.10.6"},{"introduced":"15.0"},{"last_affected":"15.0"}],"source":["CPE_RANGE","CPE_STRING"],"cpe":["cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","cpe:2.3:a:xwiki:xwiki:15.0:*:*:*:*:*:*:*"]}},{"type":"GIT","repo":"https://github.com/xwiki/xwiki-platform","events":[{"introduced":"957531709abb059f445eb70ccecf4f6cbce986b6"},{"fixed":"b469b950e7fe3d22f00b639d43f286bf871472b1"},{"introduced":"c524887d154ff8f6df9651e36b904e234bf5a6ef"},{"fixed":"db1b7950037774552be2897571c2e1c5a7589400"},{"introduced":"96b4a230ee41ef74268c9720722f6473c705583d"},{"fixed":"0993a7ab3c102f9ac37ffe361a83a3dc302c0e45"},{"fixed":"6ce2d04a5779e07f6d3ed3f37d4761049b4fc3ac"}],"database_specific":{"cpe":["cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","cpe:2.3:a:xwiki:xwiki:15.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"12.9"},{"fixed":"14.4.8"},{"introduced":"14.10"},{"fixed":"14.10.6"},{"introduced":"15.0"},{"last_affected":"15.0"}],"source":["CPE_RANGE","CPE_STRING","REFERENCES"]}}],"versions":["15.0","xwiki-commons-14.10.5","xwiki-commons-14.10.4","xwiki-commons-15.0","xwiki-commons-14.10.3","xwiki-commons-14.10.2","xwiki-commons-14.10.1","xwiki-commons-14.10","xwiki-platform-14.10.5","xwiki-platform-14.10.4","xwiki-platform-14.10.3","xwiki-platform-14.10.2","xwiki-platform-14.10.1","xwiki-platform-14.10"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-35152.json","vanir_signatures_modified":"2026-08-12T14:51:05Z","vanir_signatures":[{"digest":{"function_hash":"108013058048315318989389995389115188975","length":57},"id":"CVE-2023-35152-002459f5","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/0993a7ab3c102f9ac37ffe361a83a3dc302c0e45","target":{"function":"dispose","file":"xwiki-platform-core/xwiki-platform-like/xwiki-platform-like-api/src/main/java/org/xwiki/like/internal/DefaultLikeManager.java"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["78092718867657142493592034427816036413","3583382527629898726239598230472055319"],"threshold":0.9},"id":"CVE-2023-35152-14d4562e","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/0993a7ab3c102f9ac37ffe361a83a3dc302c0e45","target":{"file":"xwiki-platform-core/xwiki-platform-like/xwiki-platform-like-api/src/test/java/org/xwiki/like/internal/DefaultLikeManagerTest.java"}},{"target":{"file":"xwiki-platform-core/xwiki-platform-like/xwiki-platform-like-api/src/main/java/org/xwiki/like/script/LikeScriptService.java"},"deprecated":false,"digest":{"line_hashes":["42596532390494141964913274341986790881","110724726295912202654593890427561008364","142324323199052876820229770819312990635"],"threshold":0.9},"id":"CVE-2023-35152-342886e7","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/0993a7ab3c102f9ac37ffe361a83a3dc302c0e45"},{"signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/0993a7ab3c102f9ac37ffe361a83a3dc302c0e45","target":{"file":"xwiki-platform-core/xwiki-platform-like/xwiki-platform-like-api/src/main/java/org/xwiki/like/internal/DefaultLikeManager.java"},"deprecated":false,"digest":{"line_hashes":["153343030864296103107704987949784927826","61893200445043239388141735964627072893","216664644218393894236078578738037392099","133593028899533156655499655684677235518","245590790801850290475182552681953791888","175465543198553402312591616992349128726","236475409315313192995733105617029591251","40784972510516435168083725175066931579","279408143741698458516630925774249274486","29884500287803937506235308566091041521","220496415672285725809734828652601616425","19062969154866017586617074344660833477","329977159624647815885507365701932115997","205813689092821903462600102764524668769","109537427714201808122554174519018304433","287198507216424758845407703355001681406","38438586745246524914520709518613337072","283507447998242644937121982250089343504","213174757657204818957536484613150768491"],"threshold":0.9},"id":"CVE-2023-35152-65cec367","signature_type":"Line"},{"deprecated":false,"digest":{"line_hashes":["245189121525260966262248970310143963203","245097187054742766657834439973421582310","57433205059129598294536086505201565139","159363660672494435621672375413529802392","85853456439833275472284682745008516785","268162827598562539263032627361623005424"],"threshold":0.9},"id":"CVE-2023-35152-73257d93","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/0993a7ab3c102f9ac37ffe361a83a3dc302c0e45","target":{"file":"xwiki-platform-core/xwiki-platform-like/xwiki-platform-like-api/src/main/java/org/xwiki/like/LikeManager.java"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/0993a7ab3c102f9ac37ffe361a83a3dc302c0e45","target":{"file":"xwiki-platform-core/xwiki-platform-like/xwiki-platform-like-api/src/test/java/org/xwiki/like/script/LikeScriptServiceTest.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["280410508760815690942653365066069237837","37679175397079079891579535508326850852","333471091098568387051893414935360641182","296384556553637419951792533426535932281","326978057014718403445339297445322188496","338230266337898065118848058691866104307","2793220040292905920569248064424005715","116101382437245569514806631223163493061"]},"id":"CVE-2023-35152-dcf3a1a7"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}]}