Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2023-29523

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user who can edit their own user profile can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. The same vulnerability can also be exploited in other contexts where the `display` method on a document is used to display a field with wiki syntax, for example in applications created using `App Within Minutes`. This has been patched in XWiki 13.10.11, 14.4.8, 14.10.2 and 15.0RC1. There is no workaround apart from upgrading.

Published

2023-04-19T00:15:08.987

Last Modified

2024-11-21T07:57:13.700

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 9.9 (CRITICAL)

Weaknesses

Type: Secondary
CWE-74

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	xwiki	xwiki	< 13.10.11	Yes
Application	xwiki	xwiki	< 14.4.8	Yes
Application	xwiki	xwiki	< 14.10.2	Yes

References

https://extensions.xwiki.org/xwiki/bin/view/Extension/App%20Within%20Minutes%20Application Product ([email protected])
https://github.com/xwiki/xwiki-platform/commit/0d547181389f7941e53291af940966413823f61c Patch ([email protected])
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-x764-ff8r-9hpx Exploit, Patch, Vendor Advisory ([email protected])
https://jira.xwiki.org/browse/XWIKI-20327 Exploit, Issue Tracking, Patch, Vendor Advisory ([email protected])
https://extensions.xwiki.org/xwiki/bin/view/Extension/App%20Within%20Minutes%20Application Product (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/xwiki/xwiki-platform/commit/0d547181389f7941e53291af940966413823f61c Patch (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-x764-ff8r-9hpx Exploit, Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://jira.xwiki.org/browse/XWIKI-20327 Exploit, Issue Tracking, Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)