1. Home
  2. Vulnerabilities
  3. CVE-2023-30537

CVE-2023-30537

CVSS v3.1 8.8 (High)
88% Progress
EPSS 0.18 % (56th)
0.18% Progress
Affected Products 1
Advisories 1
Info CVSS EPSS CAPEC Affected Configurations References Security Advisories Packages & Software Tools, Exploits & PoC Graph Web & Social Timeline

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with the right to add an object on a page can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of the styles properties FlamingoThemesCode.WebHome. This page is installed by default. The vulnerability has been patched in XWiki versions 13.10.11, 14.4.7 and 14.10.

Weaknesses
CWE-94
Improper Control of Generation of Code ('Code Injection')
CWE-95
Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
CVE Status
PUBLISHED
CNA
GitHub, Inc.
Published Date
2023-04-16 08:15:07
(17 months ago)
Updated Date
2023-04-26 20:07:04
(17 months ago)

Affected Products

Xwiki

Configuration #1

    CPE23 From Up To
  Xwiki from 12.6.6 version and prior 13.10.11 version cpe:2.3:a:xwiki:xwiki >= 12.6.6 < 13.10.11
  Xwiki from 14.0 version and prior 14.4.7 version cpe:2.3:a:xwiki:xwiki >= 14.0 < 14.4.7
  Xwiki from 14.5 version and prior 14.10 version cpe:2.3:a:xwiki:xwiki >= 14.5 < 14.10