9.9

CVE-2023-29511

Exploit

xwiki-platform-administration-ui vulnerable to privilege escalation

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with edit rights on a page (e.g., it's own user page), can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of the section ids in `XWiki.AdminFieldsDisplaySheet`. This page is installed by default. The vulnerability has been patched in XWiki versions 15.0-rc-1, 14.10.1, 14.4.8, and 13.10.11.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Xwiki ≫ Xwiki Version >= 1.7 < 13.10.11
Xwiki ≫ Xwiki Version > 14.0 < 14.4.8
Xwiki ≫ Xwiki Version >= 14.5 < 14.10.1
Xwiki ≫ Xwiki Version14.0 Update-
Xwiki ≫ Xwiki Version14.0 Updaterc1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.04% 0.594
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
security-advisories@github.com 9.9 3.1 6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").

https://github.com/xwiki/xwiki-platform/commit/f1e310826a19acdcdecdecdcfe171d21f24d6ede
Patch
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-rfh6-mg6h-h668
Patch
Vendor Advisory
https://jira.xwiki.org/browse/XWIKI-20261
Patch
Vendor Advisory
Exploit
Issue Tracking