Lucene search

PRIOn knowledge basePRION:CVE-2023-50732

HistoryDec 21, 2023 - 8:15 p.m.

Code injection

2023-12-2120:15:00

PRIOn knowledge base

www.prio-n.com

xwiki platform

code injection

velocity script

document tree

nvd

7.3 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

39.7%

JSON

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It’s possible to execute a Velocity script without script right through the document tree. This has been patched in XWiki 14.10.7 and 15.2RC1.

CPENameOperatorVersion
xwikige15.0
xwikilt15.2
xwikige8.3
xwikilt14.10.7

Name	Operator	Version
xwiki	ge	15.0
xwiki	lt	15.2
xwiki	ge	8.3
xwiki	lt	14.10.7

References

github.com/xwiki/xwiki-platform/commit/41d7dca2d30084966ca6a7ee537f39ee8354a7e3

github.com/xwiki/xwiki-platform/security/advisories/GHSA-p5f8-qf24-24cj

jira.xwiki.org/browse/XWIKI-20625