{"id":"CVE-2023-35166","summary":"Privilege escalation (PR) from account through TipsPanel","details":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to execute any wiki content with the right of the TipsPanel author by creating a tip UI extension. This has been patched in XWiki 15.1-rc-1 and 14.10.5.\n","aliases":["GHSA-h7cw-44vp-jq7h"],"modified":"2026-08-12T14:50:45.533792Z","published":"2023-06-20T19:29:51.912Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-863"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/35xxx/CVE-2023-35166.json"},"references":[{"type":"WEB","url":"https://jira.xwiki.org/browse/XWIKI-20281"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/35xxx/CVE-2023-35166.json"},{"type":"ADVISORY","url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-h7cw-44vp-jq7h"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-35166"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/98208c5bb1e8cdf3ff1ac35d8b3d1cb3c28b3263#diff-4e3467d2ef3871a68b2f910e67cf84531751b32e0126321be83c0f1ed5d90b29L176-R178"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/xwiki/xwiki-commons","events":[{"introduced":"6b0f407f00b668efda8e19aa41aee776f82dcd78"},{"fixed":"8dfb9fcb4f456c70f82ea670ca0e2f3dee373ee4"}],"database_specific":{"cpe":"cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"8.1"},{"fixed":"14.10.5"}],"source":"CPE_RANGE"}},{"type":"GIT","repo":"https://github.com/xwiki/xwiki-platform","events":[{"introduced":"f355cbb3060b160d571f3034f50509df89466a04"},{"fixed":"0cb75bab7ac0c3ecbd0429e88726435b55970c8e"},{"fixed":"98208c5bb1e8cdf3ff1ac35d8b3d1cb3c28b3263"}],"database_specific":{"source":["CPE_RANGE","REFERENCES"],"cpe":"cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"8.1"},{"fixed":"14.10.5"}]}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-35166.json","vanir_signatures_modified":"2026-08-12T14:50:45Z","vanir_signatures":[{"source":"https://github.com/xwiki/xwiki-platform/commit/98208c5bb1e8cdf3ff1ac35d8b3d1cb3c28b3263","target":{"file":"xwiki-platform-core/xwiki-platform-test/xwiki-platform-test-ui/src/main/java/org/xwiki/test/ui/TestUtils.java","function":"executeAndGetBodyAsString"},"deprecated":false,"digest":{"function_hash":"14447729309296387817418829718357370229","length":225},"id":"CVE-2023-35166-79b79c6d","signature_type":"Function","signature_version":"v1"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/98208c5bb1e8cdf3ff1ac35d8b3d1cb3c28b3263","target":{"file":"xwiki-platform-core/xwiki-platform-panels/xwiki-platform-panels-test/xwiki-platform-panels-test-pageobjects/src/main/java/org/xwiki/panels/test/po/PanelViewPage.java"},"deprecated":false,"digest":{"line_hashes":["25925747755441636746350101931272565222","147219099890536987013760555543393223535","333699726436675346995611010037943442162","53947442270850455060094310709181132798","301580855568517563688922281630698926591","89042228836623502674888688411835274673","296359591089317611326373224281631006506","25974458481816779495127126247766411441"],"threshold":0.9},"id":"CVE-2023-35166-c823767c"},{"target":{"file":"xwiki-platform-core/xwiki-platform-test/xwiki-platform-test-ui/src/main/java/org/xwiki/test/ui/TestUtils.java","function":"toQueryString"},"deprecated":false,"digest":{"function_hash":"166246384768364013003536269361668174517","length":227},"id":"CVE-2023-35166-eac022cd","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/98208c5bb1e8cdf3ff1ac35d8b3d1cb3c28b3263"},{"deprecated":false,"digest":{"line_hashes":["266633864228528493549386452371347433207","43735441723254684101747426884598112759","47384835865222440417190816139285189514","313878927082735046488116322325606766041","122482562407068278039949829497503724801","189707283566078500388873243356629685322","6561773432538060453508578616831934461","294454540879940323135238187662023702626","48556899269463793951767124440096753382","294680639907059971014533667933508619893","292207954594304436987304925560526556172","94739373799461362790737694673923578219","303190057645613868296880879130810771082","157893764397825346600080687898137392550","125216989455414087892348001982983804144","97732989549031072294872074751396201599","203492244711342818278625656255727341325","151873724696478795592841728622958662369","134653291192210524618792979307894980066","287501509234433704248035340288702479765","202414337698643116640640628805582540639","281216225390419403474826711798445416660"],"threshold":0.9},"id":"CVE-2023-35166-f6b1fce3","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/98208c5bb1e8cdf3ff1ac35d8b3d1cb3c28b3263","target":{"file":"xwiki-platform-core/xwiki-platform-test/xwiki-platform-test-ui/src/main/java/org/xwiki/test/ui/TestUtils.java"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}]}