CVE-2023-29525

🗓️ 18 Apr 2023 23:01:46Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 45 Views🌐 WEB

XWiki Platform code injection vulnerability allows privilege escalation and code execution

Reporter	Title	Published	Views	Family All 12
Circl	CVE-2023-29525	19 Apr 202307:43	–	circl
CNNVD	XWiki Platform 注入漏洞	18 Apr 202300:00	–	cnnvd
Cvelist	CVE-2023-29525 Privilege escalation from view right on XWiki.Notifications.Code.LegacyNotificationAdministration in xwiki-platform	18 Apr 202323:01	–	cvelist
Github Security Blog	XWiki Platform vulnerable to privilege escalation from view right on XWiki.Notifications.Code.LegacyNotificationAdministration	20 Apr 202322:25	–	github
NVD	CVE-2023-29525	19 Apr 202300:15	–	nvd
OpenVAS	XWiki 12.6.1 < 13.10.11, 14.0-rc-1 < 14.4.8, 14.5 < 14.10.3 Privilege Escalation Vulnerability (GHSA-jgg7-w2rj-58cj)	18 Jul 202300:00	–	openvas
OSV	CVE-2023-29525 Privilege escalation from view right on XWiki.Notifications.Code.LegacyNotificationAdministration in xwiki-platform	18 Apr 202323:01	–	osv
OSV	GHSA-JGG7-W2RJ-58CJ XWiki Platform vulnerable to privilege escalation from view right on XWiki.Notifications.Code.LegacyNotificationAdministration	20 Apr 202322:25	–	osv
Prion	Code injection	19 Apr 202300:15	–	prion
Positive Technologies	PT-2023-8612 · Xwiki · Xwiki Platform	18 Apr 202300:00	–	ptsecurity

NVD

Vulners

Node

xwiki xwikiRange<14.4.8

xwiki xwikiRange14.5–14.10.3

[
  {
    "vendor": "xwiki",
    "product": "xwiki-platform",
    "versions": [
      {
        "version": "< 14.4.8",
        "status": "affected"
      },
      {
        "version": ">= 14.5.0, < 14.10.3.",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/xwiki/xwiki-platform/commit/6d74e2e4aa03d19f0be385ab63ae9e0f0e90a766
github	www.github.com/xwiki/xwiki-platform/security/advisories/GHSA-jgg7-w2rj-58cj
github	www.github.com/xwiki/xwiki-platform/commit/8e7c7f90f2ddaf067cb5b83b181af41513028754
jira	www.jira.xwiki.org/browse/XWIKI-20287

Parameter	Position	Path	Description	CWE
since	query param	/xwiki/bin/view/XWiki/Notifications/Code/LegacyNotificationAdministration	Code injection via the since parameter causing XWiki syntax injection and privilege escalation.	CWE-74

21 Nov 2024 07:57Current

9.6High risk

Vulners AI Score9.6

CVSS 3.18.8 - 9.9

EPSS0.54257

SSVC

CWE-74