CVE-2023-29521

moderate-risk
Published 2023-04-19

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with view rights can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of `Macro.VFSTreeMacro`. This page is not installed by default.This vulnerability has been patched in XWiki 15.0-rc-1, 14.10.2, 14.4.8, 13.10.11. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Do I need to act?

!
14.9% chance of exploitation in next 30 days
EPSS score — higher than 85% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
8
CVSS 8.4/10 High
NETWORK / HIGH complexity

Affected Products (1)

Affected Vendors

Xwiki

References (6)

Patch https://github.com/xwiki/xwiki-platform/commit/fad02328f5ec7ab7fe5b932ffb5bc5c1b...
Exploit https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-p67q-h88v-5jgr
Exploit https://jira.xwiki.org/browse/XWIKI-20260
Patch https://github.com/xwiki/xwiki-platform/commit/fad02328f5ec7ab7fe5b932ffb5bc5c1b...
Exploit https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-p67q-h88v-5jgr
Exploit https://jira.xwiki.org/browse/XWIKI-20260
42
/ 100
moderate-risk
Severity 25/34 · High
Exploitability 12/34 · Low
Exposure 5/34 · Minimal