Lucene search
PRIOn knowledge basePRION:CVE-2023-29521HistoryApr 19, 2023 - 12:15 a.m.
Design/Logic Flaw
2023-04-1900:15:00
PRIOn knowledge base
www.prio-n.com
2
xwiki platform
arbitrary code execution
macro.vfstreemacro
full access
installation
patched
upgrade
vulnerability
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with view rights can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of Macro.VFSTreeMacro. This page is not installed by default.This vulnerability has been patched in XWiki 15.0-rc-1, 14.10.2, 14.4.8, 13.10.11. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Related
cvelist
cvelist
osv
osv
XWiki Platform vulnerable to code injection from account/view through VFS Tree macro
2023-04-20 22:06:19
CVE-2023-29521
2023-04-19 00:15:08
github
github
openvas
openvas
nvd
nvd
CVE-2023-29521
2023-04-19 00:15:08
cve
cve
CVE-2023-29521
2023-04-19 00:15:08