{"id":"CVE-2023-46244","summary":"Privilege escalation in Xwiki platform","details":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible for a user to write a script in which any velocity content is executed with the right of any other document content author. Since this API require programming right and the user does not have it, the expected result is `$doc.document.authors.contentAuthor` (not executed script), unfortunately with the security vulnerability it is possible for the attacker to get `XWiki.superadmin` which shows that the title was executed with the right of the unmodified document. This has been patched in XWiki versions 14.10.7 and 15.2RC1. Users are advised to upgrade. There are no known workarounds for this vulnerability.","aliases":["GHSA-rmxw-c48h-2vf5"],"modified":"2026-08-12T14:51:20.761983Z","published":"2023-11-07T19:04:44.532Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-863"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46244.json"},"references":[{"type":"WEB","url":"https://jira.xwiki.org/browse/XWIKI-20624"},{"type":"WEB","url":"https://jira.xwiki.org/browse/XWIKI-20625"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46244.json"},{"type":"ADVISORY","url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-rmxw-c48h-2vf5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-46244"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/11a9170dfe63e59f4066db67f84dbfce4ed619c6"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/41d7dca2d30084966ca6a7ee537f39ee8354a7e3"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/xwiki/xwiki-commons","events":[{"introduced":"09af15d4432bf2c8262f37542a0a7ffdbb719aea"},{"fixed":"1e168fcaa5e247cbb1c03ee66e5cffbcd36e3d71"},{"introduced":"fdba4ca1398766e912f7888af5bdefbeef60d8b0"},{"fixed":"16d8434e51afd80d6f06568c8449eb0c9fbfdb40"},{"introduced":"debbc2712f681f1f0ce1f0ba4ed295d37813b596"},{"last_affected":"debbc2712f681f1f0ce1f0ba4ed295d37813b596"}],"database_specific":{"cpe":["cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","cpe:2.3:a:xwiki:xwiki:3.2:milestone3:*:*:*:*:*:*"],"extracted_events":[{"introduced":"3.3"},{"fixed":"14.10.7"},{"introduced":"15.0"},{"fixed":"15.2"},{"introduced":"3.2-milestone3"},{"last_affected":"3.2-milestone3"}],"source":["CPE_RANGE","CPE_STRING"]}},{"type":"GIT","repo":"https://github.com/xwiki/xwiki-platform","events":[{"introduced":"5af482676d6b9b3c06a440ad4918cdf715bf8542"},{"fixed":"e6857070533992f14bb81691dcdf4c315792656d"},{"introduced":"96b4a230ee41ef74268c9720722f6473c705583d"},{"fixed":"7d8a0fa4bef8e285a5aa1e65d78d05e10f3800ab"},{"introduced":"817e71d7c385e25600f16c5ed7245eaa20fee43a"},{"fixed":"11a9170dfe63e59f4066db67f84dbfce4ed619c6"},{"fixed":"41d7dca2d30084966ca6a7ee537f39ee8354a7e3"}],"database_specific":{"extracted_events":[{"introduced":"3.3"},{"fixed":"14.10.7"},{"introduced":"15.0"},{"fixed":"15.2"},{"introduced":"3.2-milestone3"},{"last_affected":"3.2-milestone3"}],"source":["CPE_RANGE","CPE_STRING","REFERENCES"],"cpe":["cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","cpe:2.3:a:xwiki:xwiki:3.2:milestone3:*:*:*:*:*:*"]}}],"versions":["3.2-milestone3","xwiki-commons-3.2-milestone-3"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-46244.json","vanir_signatures_modified":"2026-08-12T14:51:20Z","vanir_signatures":[{"target":{"file":"xwiki-platform-core/xwiki-platform-display/xwiki-platform-display-api/src/main/java/org/xwiki/display/internal/AbstractDocumentTitleDisplayer.java"},"deprecated":false,"digest":{"line_hashes":["233777462921491016932100120636745277402","100859743450383697060586428764497202414","116086917818654258985706148975130691453","141700616978494245241693397843651485049","52580502947531045104016919754964531732","94149276433752228582176246430657137210","337572113323226655974976622292575229988","40850483141054295596778050371807065784","284458518908991386771725717820224014912","315193220554283708974760463626219327537","235528156822352472369540729236761768731","32903052743930052623630623164261966865","219815421423027477692322401107390492153","265731253714766676339745334922513918315","98903869661212489183773092097051360999","174479771267933473444307264066820084819","40907154127992393146499722151614406642","314453944008220420537312048065041367704","171180722126843676937933464075189467730"],"threshold":0.9},"id":"CVE-2023-46244-46923fde","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/11a9170dfe63e59f4066db67f84dbfce4ed619c6"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/11a9170dfe63e59f4066db67f84dbfce4ed619c6","target":{"file":"xwiki-platform-core/xwiki-platform-flamingo/xwiki-platform-flamingo-skin/xwiki-platform-flamingo-skin-test/xwiki-platform-flamingo-skin-test-docker/src/test/it/org/xwiki/flamingo/test/docker/AllITs.java"},"deprecated":false,"digest":{"line_hashes":["223901302667221464561201166298352596413","271980745013691977715545755429370480021"],"threshold":0.9},"id":"CVE-2023-46244-5e307005"},{"source":"https://github.com/xwiki/xwiki-platform/commit/11a9170dfe63e59f4066db67f84dbfce4ed619c6","target":{"function":"evaluateTitle","file":"xwiki-platform-core/xwiki-platform-display/xwiki-platform-display-api/src/main/java/org/xwiki/display/internal/AbstractDocumentTitleDisplayer.java"},"deprecated":false,"digest":{"function_hash":"237817006297586495345947282323681012166","length":871},"id":"CVE-2023-46244-6b6d296b","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"250149496543197114063155126582096064008","length":808},"id":"CVE-2023-46244-771cfd98","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/11a9170dfe63e59f4066db67f84dbfce4ed619c6","target":{"file":"xwiki-platform-core/xwiki-platform-display/xwiki-platform-display-api/src/main/java/org/xwiki/display/internal/AbstractDocumentTitleDisplayer.java","function":"displayTitle"}},{"deprecated":false,"digest":{"line_hashes":["23292428321038442200302566988962406118","116523678021916233717112948374732957969","138730200662838411530440957584704375326","191861419914291137626840523576259353199","332111862124076805688448944921261876414","172508089805255741745774265637357742181","230802713362981387369779119445802541191","41219434407329820349324152237493013248"],"threshold":0.9},"id":"CVE-2023-46244-fa33fcd7","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/11a9170dfe63e59f4066db67f84dbfce4ed619c6","target":{"file":"xwiki-platform-core/xwiki-platform-display/xwiki-platform-display-api/src/test/java/org/xwiki/display/internal/DocumentTitleDisplayerTest.java"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"}]}