CVE-2023-29516
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with view rights on `XWiki.AttachmentSelector` can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping in the "Cancel and return to page" button. This page is installed by default. This vulnerability has been patched in XWiki 15.0-rc-1, 14.10.1, 14.4.8, and 13.10.11. There are no known workarounds for this vulnerability.
Published
2023-04-19T00:15:08.423
Last Modified
2024-11-21T07:57:12.890
Status
Modified
Source
[email protected]
Severity
CVSSv3.1: 9.9 (CRITICAL)
Weaknesses
Affected Vendors & Products
| Type |
Vendor |
Product |
Version/Range |
Vulnerable? |
| Application |
xwiki
|
xwiki
|
< 13.10.11 |
Yes
|
| Application |
xwiki
|
xwiki
|
< 14.4.8 |
Yes
|
| Application |
xwiki
|
xwiki
|
< 14.10.1 |
Yes
|
References
-
https://github.com/xwiki/xwiki-platform/commit/aca1d677c58563bbe6e35c9e1c29fd8b12ebb996
Patch
([email protected])
-
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-3989-4c6x-725f
Exploit, Patch, Vendor Advisory
([email protected])
-
https://jira.xwiki.org/browse/XWIKI-20275
Exploit, Issue Tracking, Patch, Vendor Advisory
([email protected])
-
https://github.com/xwiki/xwiki-platform/commit/aca1d677c58563bbe6e35c9e1c29fd8b12ebb996
Patch
(af854a3a-2127-422b-91ae-364da2661108)
-
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-3989-4c6x-725f
Exploit, Patch, Vendor Advisory
(af854a3a-2127-422b-91ae-364da2661108)
-
https://jira.xwiki.org/browse/XWIKI-20275
Exploit, Issue Tracking, Patch, Vendor Advisory
(af854a3a-2127-422b-91ae-364da2661108)