{"id":"CVE-2023-35166","published":"2023-06-20T19:29:51Z","modified":"2024-12-06T21:35:31Z","title":"Privilege escalation (PR) from account through TipsPanel","vendor":"xwiki","product":"xwiki-platform","tier":"core","eol":null,"affectedVersions":[{"vendor":"xwiki","product":"xwiki-platform","versions":[">= 8.1-milestone-1, < 14.10.5",">= 15.0-rc-1, < 15.1-rc-1"]}],"description":{"text":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to execute any wiki content with the right of the TipsPanel author by creating a tip UI extension. This has been patched in XWiki 15.1-rc-1 and 14.10.5.\n","provenance":"source","from":"CVE.org"},"summary":{"text":"The flaw is an incorrect authorization issue in the TipsPanel component of xwiki-platform, the generic wiki platform from XWiki. An attacker with a low-privileged account who creates a tip UI extension can get wiki content executed with the rights of the TipsPanel author, and this network-reachable attack requires no user interaction.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:14:19Z"},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.62172,"percentile":0.99178,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[{"id":"CWE-863","name":"Incorrect Authorization"}],"references":[{"url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-h7cw-44vp-jq7h","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/xwiki/xwiki-platform/commit/98208c5bb1e8cdf3ff1ac35d8b3d1cb3c28b3263#diff-4e3467d2ef3871a68b2f910e67cf84531751b32e0126321be83c0f1ed5d90b29L176-R178","tags":["x_refsource_MISC"]},{"url":"https://jira.xwiki.org/browse/XWIKI-20281","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-help-ui","vulnerableRanges":[">=8.1-milestone-1, <14.10.5",">=15.0-rc-1, <15.1-rc-1"],"patched":["14.10.5","15.1-rc-1"],"from":["GHSA-h7cw-44vp-jq7h"],"provenance":"source"}],"advisories":[{"id":"GHSA-h7cw-44vp-jq7h","url":"https://github.com/advisories/GHSA-h7cw-44vp-jq7h","severity":"HIGH","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-help-ui","vulnerableRanges":[">=8.1-milestone-1, <14.10.5"],"patched":["14.10.5"],"provenance":"source","from":"GHSA"},{"id":"GHSA-h7cw-44vp-jq7h","url":"https://github.com/advisories/GHSA-h7cw-44vp-jq7h","severity":"HIGH","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-help-ui","vulnerableRanges":[">=15.0-rc-1, <15.1-rc-1"],"patched":["15.1-rc-1"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2023-1816","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-1816","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2023-06-20","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2023-35166","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":26.8,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.84,"detail":"percentile 0.9918"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":7.0,"detail":"base score 10"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"packageHistory":[{"cve":"CVE-2023-35166","published":"2023-06-20","fixed":"15.1-rc-1","kev":false},{"cve":"CVE-2024-55877","published":"2024-12-12","fixed":"16.5.0","kev":false,"link":{"from":"CVE-2023-35166","to":"CVE-2024-55877","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.xwiki.platform:xwiki-platform-help-ui","fromFixed":"15.1-rc-1","toFixed":"15.10.11","daysApart":541}]}}],"package":"Maven:org.xwiki.platform:xwiki-platform-help-ui"}}