PT-2023-22207 · Xwiki · Xwiki

Michael Hamann · Published 2023-04-12 · Updated 2023-04-26 · CVE-2023-29211

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions XWiki versions prior to 13.10.11 XWiki versions prior to 14.4.7 XWiki versions prior to 14.10

Description The issue allows any user with view rights WikiManager.DeleteWiki to execute arbitrary Groovy, Python, or Velocity code in XWiki, leading to full access to the XWiki installation. The root cause is improper escaping of the wikiId url parameter.

Recommendations For XWiki versions prior to 13.10.11, update to version 13.10.11 or later. For XWiki versions prior to 14.4.7, update to version 14.4.7 or later. For XWiki versions prior to 14.10, update to version 14.10 or later. As a temporary workaround, consider restricting access to the WikiManager.DeleteWiki function until a patch is applied. Avoid using the wikiId parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

Code Injection

Eval Injection

Weakness Enumeration

CWE-94

CWE-95

Related Identifiers

CVE-2023-29211

GHSA-W7V9-FC49-4QG4

Affected Products

Xwiki

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/29xxx/CVE-2023-29211.json · Exploit
• 🔥 https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-w7v9-fc49-4qg4 · Exploit
• 🔥 https://jira.xwiki.org/browse/XWIKI-20297 · Exploit
• https://github.com/xwiki/xwiki-platform/commit/ba4c76265b0b8a5e2218be400d18f08393fe1428#diff-64f39f5f2cc8c6560a44e21a5cfd509ef00e8a2157cd9847c9940a2e08ea43d1R63-R64 · Patch
• https://osv.dev/vulnerability/GHSA-w7v9-fc49-4qg4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-29211 · Security Note
• https://osv.dev/vulnerability/CVE-2023-29211 · Vendor Advisory
• https://github.com/xwiki/xwiki-platform · Note
• https://t.me/cvenotify/48374 · Telegram Post