CVE-2023-40177

Summary

CVE-2023-40177 is a vulnerability affecting the XWiki Platform, a wiki solution with runtime services for applications built on it. This issue allows any registered user to execute arbitrary scripts with programming rights on their user profile page, resulting in rights escalation. The vulnerability emerged in version 4.3M2 when the AppWithinMinutes Application added support for the Content field. Unsecured use of this feature enabled any wiki page, including user profile pages, to adopt the AWM Content field and its custom displayer, which runs the content with the rights of the "AppWithinMinutes.Content" author. The vulnerability has been rectified in XWiki 14.10.5 and 15.1RC1 through modifications to the AppWithinMinutes.Content page's custom displayer, ensuring appropriate access rights checks during script rendering.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.