CVE-2023-6886 xnx3 wangmarket Role Management Page code injection

Medium 4.7 Published 17 Dec 2023 Updated 2 Aug 2024

Remote attackers can execute arbitrary code via the Role Management Page in wangmarket, requiring permissions but posing a critical risk.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-6886?

CVE-2023-6886 is a medium-severity code injection vulnerability in xnx3 wangmarket, published on 17 Dec 2023. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

A vulnerability was found in xnx3 wangmarket 6.1. It has been rated as critical. Affected by this issue is some unknown functionality of the component Role Management Page. The manipulation leads to code injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-248246 is the identifier assigned to this vulnerability.

Weakness: CWE-94

Which versions are affected by CVE-2023-6886?

2 open source packages ship an affected version, including com.xnx3.wangmarket:wangmarket. It affects 1 product.

Package	Affected	Fixed in
`com.xnx3.wangmarket:wangmarket` Maven	All versions to `6.1.0`	None
`com.xnx3.wangmarket:wangmarket` Maven	All versions to `6.1.0`	None

Products include Wang.market Wangmarket.

How do I fix CVE-2023-6886?

No fix has been published for CVE-2023-6886 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2023-6886 being exploited?

There is no known exploitation of CVE-2023-6886 in the wild and no public exploit code.

Sources

Also known as GHSA-3x3w-849q-423v.