CVE-2023-29518 Code injection from view right using Invitation.InvitationCommon in xwiki-platform

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with view rights can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of...

CVE-2023-29518 Code injection from view right using Invitation.InvitationCommon in xwiki-platform

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with view rights can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of...

CVE-2023-29518 Code injection from view right using Invitation.InvitationCommon in xwiki-platform

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with view rights can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of...

CVE-2023-29518

Summary: CVE-2023-29518 affects XWiki Platform. Affected: XWiki Platform installations allowing any user with view rights to execute arbitrary Groovy, Python, or Velocity code, yielding full control over the XWiki installation. Root cause: improper escaping of Invitation.InvitationCommon. Impact:...

CVE-2023-29523 Code injection in display method used in user profiles in xwiki-platform

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user who can edit their own user profile can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write acces...

CVE-2023-29523 Code injection in display method used in user profiles in xwiki-platform

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user who can edit their own user profile can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write acces...

CVE-2023-29523 Code injection in display method used in user profiles in xwiki-platform

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user who can edit their own user profile can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write acces...

CVE-2023-29523

CVE-2023-29523 – XWiki Platform code injection via display method : Affects XWiki Platform where any user who can edit their own profile can run arbitrary script macros (Groovy/Python), enabling remote code execution and unrestricted read/write of wiki content. The vulnerability can also occur wh...

CVE-2023-29524 Code injection from account through XWiki.SchedulerJobSheet in xwiki-platform

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to execute anything with the right of the Scheduler Application sheet page. A user without script or programming rights, edit your user profile with the object editor and add a n...

CVE-2023-29524 Code injection from account through XWiki.SchedulerJobSheet in xwiki-platform

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to execute anything with the right of the Scheduler Application sheet page. A user without script or programming rights, edit your user profile with the object editor and add a n...

CVE-2023-29524

The CVE affects XWiki Platform. A groovy script can be injected via the SchedulerJobSheet when a user without scripting rights edits their profile and adds a XWiki.SchedulerJobClass, causing server-side code execution on view. The issue has been patched in XWiki 14.10.3 and 15.0 RC1; upgrading is...

CVE-2023-29524 Code injection from account through XWiki.SchedulerJobSheet in xwiki-platform

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to execute anything with the right of the Scheduler Application sheet page. A user without script or programming rights, edit your user profile with the object editor and add a n...

CVE-2023-29525 Privilege escalation from view right on XWiki.Notifications.Code.LegacyNotificationAdministration in xwiki-platform

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Affected versions of xwiki are subject to code injection in the since parameter of the /xwiki/bin/view/XWiki/Notifications/Code/LegacyNotificationAdministration endpoint. This provides an XWik...

CVE-2023-29525 Privilege escalation from view right on XWiki.Notifications.Code.LegacyNotificationAdministration in xwiki-platform

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Affected versions of xwiki are subject to code injection in the since parameter of the /xwiki/bin/view/XWiki/Notifications/Code/LegacyNotificationAdministration endpoint. This provides an XWik...

CVE-2023-29525 Privilege escalation from view right on XWiki.Notifications.Code.LegacyNotificationAdministration in xwiki-platform

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Affected versions of xwiki are subject to code injection in the since parameter of the /xwiki/bin/view/XWiki/Notifications/Code/LegacyNotificationAdministration endpoint. This provides an XWik...

CVE-2023-29525

CVE-2023-29525 covers a privilege-escalation vulnerability in XWiki Platform. An injection flaw exists in the since parameter of the endpoint /xwiki/bin/view/XWiki/Notifications/Code/LegacyNotificationAdministration, allowing an XWiki syntax injection that can escalate from view to programming ri...

CVE-2023-29526 Async and display macro allow displaying and interacting with any document in restricted mode

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible to display or interact with any page a user cannot access through the combination of the async and display macros. A comment with either macro will be execut...

CVE-2023-29526 Async and display macro allow displaying and interacting with any document in restricted mode

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible to display or interact with any page a user cannot access through the combination of the async and display macros. A comment with either macro will be execut...

CVE-2023-29526 Async and display macro allow displaying and interacting with any document in restricted mode

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible to display or interact with any page a user cannot access through the combination of the async and display macros. A comment with either macro will be execut...

CVE-2023-29526

CVE-2023-29526 affects XWiki Platform. In affected versions, the async and display macros allow a user to display or interact with pages they should not access, enabling a code injection vector in the server context when a comment containing the macro is viewed. The issue is mitigated by upgradin...