Incorrect Privilege Assignment in XWiki platform - CVE-2023-36468
Published: June 29, 2023 / Updated: May 5, 2026
Vulnerability identifier: #VU129928
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-36468
CWE-ID: CWE-266
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to incorrect privilege assignment in old document revisions when accessing a vulnerable document revision through the rev URL parameter. A remote user can request an old vulnerable revision of a document to execute arbitrary code.
This affects upgraded installations and can also affect manually added script macros whose vulnerable versions remain in document history. Fresh installations are not affected, and content that is only loaded from the current version of a document is not affected.
Affected software
XWiki platform
How to mitigate CVE-2023-36468
Install security update from vendor's website.
XWiki platform - addressed in versions 14.10.7, 15.2