CVE-2023-29212

CRITICAL

XWiki 14.0-14.4.7 - Authenticated Remote Code Execution via Insufficient Escaping in Included Documents Edit Panel

Title source: llm

Description

XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with edit rights can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of the included pages in the included documents edit panel. The problem has been patched on XWiki 14.4.7, and 14.10.

References (3)

Core 3

Core References

Exploit, Patch, Vendor Advisory x_refsource_confirm

https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-c5f4-p5wv-2475

Patch x_refsource_misc

https://github.com/xwiki/xwiki-platform/commit/22f249a0eb9f2a64214628217e812a994419b69f#diff-a51a252f0190274464027342b4e3eafc4ae32de4d9c17ef166e54fc5454c5689R214-R217

View Patch ZIP pw:eip

Exploit, Issue Tracking x_refsource_misc

https://jira.xwiki.org/browse/XWIKI-20293

Scores

CVSS v3 9.9

EPSS 0.0119

EPSS Percentile 63.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact total

Details

CWE

CWE-95 CWE-94

Status published

Products (3)

org.xwiki.platform/xwiki-platform-panels-ui 14.0-rc-1 - 14.4.7Maven

xwiki/xwiki 14.10 rc1

xwiki/xwiki 14.0 - 14.4.7

Published Apr 16, 2023

Tracked Since Feb 18, 2026