{"id":"CVE-2023-46242","summary":"Code injection in XWiki Platform","details":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible to execute a content with the right of any user via a crafted URL. A user must have `programming` privileges in order to exploit this vulnerability. This issue has been patched in XWiki 14.10.7 and 15.2RC1. Users are advised to upgrade. There are no known workarounds for for this vulnerability.","aliases":["GHSA-hgpw-6p4h-j6h5"],"modified":"2026-08-12T14:51:20.069723Z","published":"2023-11-07T19:08:09.068Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-94"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46242.json"},"references":[{"type":"WEB","url":"https://jira.xwiki.org/browse/XWIKI-20386"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46242.json"},{"type":"ADVISORY","url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-hgpw-6p4h-j6h5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-46242"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/cf8eb861998ea423c3645d2e5e974420b0e882be"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/xwiki/xwiki-commons","events":[{"introduced":"0"},{"fixed":"1e168fcaa5e247cbb1c03ee66e5cffbcd36e3d71"},{"introduced":"fdba4ca1398766e912f7888af5bdefbeef60d8b0"},{"fixed":"16d8434e51afd80d6f06568c8449eb0c9fbfdb40"}],"database_specific":{"cpe":"cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"1.0"},{"fixed":"14.10.7"},{"introduced":"15.0"},{"fixed":"15.2"}],"source":"CPE_RANGE"}},{"type":"GIT","repo":"https://github.com/xwiki/xwiki-platform","events":[{"introduced":"93d8322eda7b68fd66f33334b982b047d7cf4f36"},{"fixed":"e6857070533992f14bb81691dcdf4c315792656d"},{"introduced":"96b4a230ee41ef74268c9720722f6473c705583d"},{"fixed":"7d8a0fa4bef8e285a5aa1e65d78d05e10f3800ab"},{"fixed":"cf8eb861998ea423c3645d2e5e974420b0e882be"}],"database_specific":{"cpe":"cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"1.0"},{"fixed":"14.10.7"},{"introduced":"15.0"},{"fixed":"15.2"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["xwiki-commons-15.2-rc-1","xwiki-commons-14.10.6","xwiki-commons-14.10.5","xwiki-commons-14.10.4","xwiki-commons-14.10.3","xwiki-commons-14.10.2","xwiki-commons-14.10.1","xwiki-commons-14.10","xwiki-commons-8.3-milestone-2","xwiki-commons-8.3-milestone-1","xwiki-commons-8.2-milestone-2","xwiki-commons-8.2-milestone-1","xwiki-commons-8.1-milestone-2","xwiki-commons-8.1-milestone-1","xwiki-commons-8.0-milestone-2","xwiki-commons-8.0-milestone-1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-46242.json","vanir_signatures_modified":"2026-08-12T14:51:20Z","vanir_signatures":[{"digest":{"function_hash":"195820319178444531691516267567277114096","length":1160},"id":"CVE-2023-46242-10d5e349","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/cf8eb861998ea423c3645d2e5e974420b0e882be","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/web/EditActionTest.java","function":"documentAuthorsWhenDocumentExistAndContentIsModified"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"186342374619521166044688866558330212207","length":835},"id":"CVE-2023-46242-2c17469b","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/cf8eb861998ea423c3645d2e5e974420b0e882be","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/web/EditAction.java","function":"prepareEditedDocument"}},{"source":"https://github.com/xwiki/xwiki-platform/commit/cf8eb861998ea423c3645d2e5e974420b0e882be","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/web/EditActionTest.java","function":"beforeEach"},"deprecated":false,"digest":{"function_hash":"195149925848134713022092233925292490103","length":355},"id":"CVE-2023-46242-51e55c92","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["133289433129283155613746193931430573168","290436475891955245534602628371599821610","300191024548013818866817165988310009055","190043460420580655024730506551568127157","52982659613002332104511637444282954069","111669611833685587838330746120919658722","156481838168188112532425565808523688654","128949435510812361720698330622627286992","135206836851705681788157393606986430534","43645240245046618546730444032060319307","57974811186183799166149935928611031132","22295784633497099715688775017886845030","244731129542418148740486653133314768724","149425077380243507282189752779816804561","63847335233060106871755130457473096051","169381083206486006989672951179457256245","335080472906782067064240742441734711953","217062532508802270782005206837368664608","108171387320321287548971750611523948330","93414117168173005209659091048302485216"],"threshold":0.9},"id":"CVE-2023-46242-b1a93faa","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/cf8eb861998ea423c3645d2e5e974420b0e882be","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/web/EditAction.java"}},{"deprecated":false,"digest":{"line_hashes":["253417284057365221306147747585425061698","245896957256513455880181749400801133762","187727686158683415434001164760305754379","83236297266098886757087614159696188921","293575470021274083002077044259517135995","174283262976073612093543845728595571773","89890014147259349624677914587776621702","109617763350747916107116002121138072771","48908012293697203981814363883969112854","123976550478680273399049216226841360282","143042168395103733868830544057282216931","213044284045753842794179095083417848076","238180871432209290151212773872978638800","232474946805341436447076386653439191946","60672462648115311301532463325959250033","87824516664874872648198506082233881793","319542470587573376873262518486021327917","235307352313379178723843163420546196215","162811709714606276495360856633005140519","192494827749834363071575599688738205151","94659496681985865589614864931613371519","225310004783834031449369307728955082743","331939349488106541822807442611817357534","159703265301338334597075781361849972834","223444903404492810261481492333351700462"],"threshold":0.9},"id":"CVE-2023-46242-d13a8e78","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/cf8eb861998ea423c3645d2e5e974420b0e882be","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/web/EditActionTest.java"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"}]}