PT-2023-8609 · Unknown · Xwiki Platform

Michael Hamann · Published 2023-04-18 · Updated 2023-05-01 · CVE-2023-29527

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions XWiki Platform versions prior to 14.10.3 XWiki Platform versions prior to 15.0-rc-1

Description The issue allows a user without script or programming rights to edit a user profile or any other document with the wiki editor and add groovy script content. When the document is viewed after saving, the groovy script is executed in the server context, providing code execution. This can be exploited by a remote attacker to inject arbitrary code.

Recommendations For versions prior to 14.10.3, upgrade to version 14.10.3 or later. For versions prior to 15.0-rc-1, upgrade to version 15.0-rc-1 or later. As a temporary workaround, consider restricting access to the wiki editor for users without script or programming rights until a patch is applied. Avoid using the groovy script content in documents until the issue is resolved.

Exploit

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

BDU:2024-01262

CVE-2023-29527

GHSA-JGRG-QVPP-9VWR

Affected Products

Xwiki Platform

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/29xxx/CVE-2023-29527.json · Exploit
• 🔥 https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-jgrg-qvpp-9vwr · Exploit
• 🔥 https://jira.xwiki.org/browse/XWIKI-20423 · Exploit
• https://osv.dev/vulnerability/GHSA-jgrg-qvpp-9vwr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-29527 · Security Note
• https://osv.dev/vulnerability/CVE-2023-29527 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-01262 · Security Note
• https://github.com/xwiki/xwiki-platform · Note