Lucene search
PRIOn knowledge basePRION:CVE-2023-29518HistoryApr 19, 2023 - 12:15 a.m.
Design/Logic Flaw
2023-04-1900:15:00
PRIOn knowledge base
www.prio-n.com
1
xwiki
arbitrary code execution
full access
patch
upgrade
security vulnerability
no workaround
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with view rights can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of Invitation.InvitationCommon. This page is installed by default. The vulnerability has been patched in XWiki 15.0-rc-1, 14.10.1, 14.4.8, and 13.10.11. Users are advised to upgrade. There are no known workarounds for this issue.
Related
cve
cve
CVE-2023-29518
2023-04-19 00:15:08
openvas
openvas
osv
osv
XWiki Platform vulnerable to privilege escalation from view right using Invitation.InvitationCommon
2023-04-20 22:04:00
CVE-2023-29518
2023-04-19 00:15:08
cvelist
cvelist
nvd
nvd
CVE-2023-29518
2023-04-19 00:15:08
github
github