Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2023-29512

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with edit rights on a page (e.g., it's own user page), can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of the information loaded from attachments in `imported.vm`, `importinline.vm`, and `packagelist.vm`. This page is installed by default. This vulnerability has been patched in XWiki 15.0-rc-1, 14.10.1, 14.4.8, and 13.10.11. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Published

2023-04-19T00:15:08.110

Last Modified

2024-11-21T07:57:12.420

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 9.9 (CRITICAL)

Weaknesses

Type: Secondary
CWE-74

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	xwiki	xwiki	< 13.10.11	Yes
Application	xwiki	xwiki	< 14.4.8	Yes
Application	xwiki	xwiki	< 14.10.1	Yes

References

https://github.com/xwiki/xwiki-platform/commit/e4bbdc23fea0be4ef1921d1a58648028ce753344 Patch ([email protected])
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-hg5x-3w3x-7g96 Exploit, Patch, Vendor Advisory ([email protected])
https://jira.xwiki.org/browse/XWIKI-20267 Exploit, Issue Tracking, Patch, Vendor Advisory ([email protected])
https://github.com/xwiki/xwiki-platform/commit/e4bbdc23fea0be4ef1921d1a58648028ce753344 Patch (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-hg5x-3w3x-7g96 Exploit, Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://jira.xwiki.org/browse/XWIKI-20267 Exploit, Issue Tracking, Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)