CVE-2023-29211

2023-04-1607:15:52

CWE-94

CWE-95

[email protected]

web.nvd.nist.gov

xwiki commons

url parameter

code execution

vulnerability

patch

versions 13.10.11

14.4.7

14.10

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

9.7 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

52.9%

JSON

XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with view rights WikiManager.DeleteWiki can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of the wikiId url parameter. The problem has been patched on XWiki 13.10.11, 14.4.7, and 14.10.

Affected configurations

NVD

Node

xwikixwikiRange<13.10.11

xwikixwikiRange14.4.0–14.4.7

xwikixwikiMatch14.10rc1

References

github.com/xwiki/xwiki-platform/commit/ba4c76265b0b8a5e2218be400d18f08393fe1428#diff-64f39f5f2cc8c6560a44e21a5cfd509ef00e8a2157cd9847c9940a2e08ea43d1R63-R64

github.com/xwiki/xwiki-platform/security/advisories/GHSA-w7v9-fc49-4qg4

jira.xwiki.org/browse/XWIKI-20297