CVE-2023-36471
CVSS Score of 10 (low)
Details
Summary
CVE-2023-36471 is a critical vulnerability affecting XWiki versions 14.6RC1 to 14.10.5 and 15.0RC1 to 15.2RC1. The vulnerability exists in the HTML sanitizer of XWiki, allowing attackers without script rights to create forms for phishing attacks or execute remote code through an input field in a sheet. This can be exploited if the attacker can submit the malicious code as an admin on the XWiki platform and create a plausible-looking edit form. The issue has been addressed in XWiki versions 14.10.6 and 15.2RC1 by removing the problematic tags from the list of allowed tags, and users are advised to upgrade as a precautionary measure to mitigate potential risks to confidentiality and integrity of data.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions