by Kastro
Paper/Archive/CVE-2023-29519

CVE-2023-29519

xwiki xwiki-platform — Code injection in org.xwiki.platform:xwiki-platform-attachment-ui

EPSS 2%public exploitCVSS 9.1
critical.is priorityof 100
53
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 80.2.802 × 2016.0Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A registered user can perform remote code execution leading to privilege escalation by injecting the proper code in the "property" field of an attachment selector, as a gadget of their own dashboard. Note that the vulnerability does not impact comments of a wiki. The vulnerability has been patched in XWiki 13.10.11, 14.4.8, 14.10.2, 15.0-rc-1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected

ProductAffectedFixed inSource
xwiki-platform< 13.10.11–CNA
xwiki-platform>= 14.0.0, < 14.4.8–CNA
xwiki-platform>= 14.5.0, < 14.10.2–CNA

Scores by source

GitHub_M (CNA)9.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

refgithub.com/xwiki/xwiki-platform/security/advisories/GHSA-3hjg-cghv-22wwrefgithub.com/xwiki/xwiki-platform/commit/5e8725b4272cd3e5be09d3ca84273be2da6869c1refjira.xwiki.org/browse/XWIKI-20364