Missing Authorization in XWiki platform - CVE-2023-37910
Published: October 25, 2023 / Updated: May 5, 2026
Vulnerability identifier: #VU129953
CSH Severity: Medium
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-37910
CWE-ID: CWE-862
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose sensitive information and modify attachments.
The vulnerability exists due to missing authorization in attachment move support in org.xwiki.platform:xwiki-platform-attachment-api when moving attachments between documents. A remote user can move an attachment from another document to an attacker-controlled document to disclose sensitive information and modify attachments.
The source attachment name must be known, and the moved attachment is deleted from the source document.
Affected software
XWiki platform
How to mitigate CVE-2023-37910
Install security update from vendor's website.
XWiki platform - addressed in versions 14.4.8, 14.10.4, 15.0