PT-2023-22206 · Xwiki · Xwiki

Michael Hamann · Published 2023-04-12 · Updated 2023-04-24 · CVE-2023-29210

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions XWiki versions prior to 13.10.11 XWiki versions prior to 14.4.7 XWiki versions prior to 14.10

Description Any user with view rights on commonly accessible documents, including the notification preferences macros, can execute arbitrary Groovy, Python, or Velocity code in XWiki, leading to full access to the XWiki installation. The root cause is improper escaping of the user parameter of the macro that provides the notification filters. These macros are used in the user profiles and thus installed by default in XWiki.

Recommendations For XWiki versions prior to 13.10.11, update to version 13.10.11 or later. For XWiki versions prior to 14.4.7, update to version 14.4.7 or later. For XWiki versions prior to 14.10, update to version 14.10 or later. As a temporary workaround, consider patching the code in the affected macros that are contained in XWiki documents as shown in the patch for this issue.

Exploit

Fix

Code Injection

Eval Injection

Weakness Enumeration

CWE-94

CWE-95

Related Identifiers

CVE-2023-29210

GHSA-P9MJ-V5MF-M82X

Affected Products

Xwiki

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/29xxx/CVE-2023-29210.json · Exploit
• 🔥 https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-p9mj-v5mf-m82x · Exploit
• 🔥 https://jira.xwiki.org/browse/XWIKI-20259 · Exploit
• https://github.com/xwiki/xwiki-platform/commit/cebf9167e4fd64a8777781fc56461e9abbe0b32a · Patch
• https://osv.dev/vulnerability/CVE-2023-29210 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-29210 · Security Note
• https://osv.dev/vulnerability/GHSA-p9mj-v5mf-m82x · Vendor Advisory
• https://github.com/xwiki/xwiki-platform · Note
• https://t.me/cibsecurity/62235 · Telegram Post