Detections
Analytics

SCA: security update for org.xwiki.platform:xwiki-platform-administration-ui (GHSA-qj86-p74r-7wp5)

high Tenable Cloud Security Plugin ID 418165

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - XWiki Platform is a generic wiki platform. Starting in 2.3 and prior to versions 14.10.15, 15.5.2, and
 15.7-rc-1, anyone who can edit an arbitrary wiki page in an XWiki installation can gain programming right
 through several cases of missing escaping in the code for displaying sections in the administration
 interface. This impacts the confidentiality, integrity and availability of the whole XWiki installation.
 Normally, all users are allowed to edit their own user profile so this should be exploitable by all users
 of the XWiki instance. This has been fixed in XWiki 14.10.15, 15.5.2 and 15.7RC1. The patches can be
 manually applied to the `XWiki.ConfigurableClassMacros` and `XWiki.ConfigurableClass` pages.
 (CVE-2023-50723)

See Also

https://github.com/advisories/GHSA-qj86-p74r-7wp5

Plugin Details

Severity: High

ID: 418165

Version: Revision 1.10

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.58

Vendor

Vendor Severity: Critical

CVSS v2

Risk Factor: High

Base Score: 9

Temporal Score: 6.7

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2023-50723

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.7

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 12/16/2023

Vulnerability Publication Date: 12/15/2023

Reference Information

CVE: CVE-2023-50723