CVE-2023-29525: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Affected versions of xwiki are subject to code…

PriorityP274high8.8CVSS 3.1

AVNACLPRLUINSUCHIHAH

EPSS

77.75%

99.5th percentile

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Affected versions of xwiki are subject to code injection in the `since` parameter of the `/xwiki/bin/view/XWiki/Notifications/Code/LegacyNotificationAdministration` endpoint. This provides an XWiki syntax injection attack via the since-parameter, allowing privilege escalation from view to programming rights and subsequent code execution privilege. The vulnerability has been patched in XWiki 15.0-rc-1, 14.10.3, 14.4.8 and 14.10.3. Users are advised to upgrade. Users unable to upgrade may modify the page `XWiki.Notifications.Code.LegacyNotificationAdministration` to add the missing escaping. For versions /templates/distribution/eventmigration.wiki` to add the missing escaping.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
xwiki	xwiki	< 14.4.8	14.4.8
xwiki	xwiki	>= 14.5 < 14.10.3	14.10.3
xwiki	xwiki-platform	< 14.4.8	14.4.8
xwiki	xwiki-platform	—	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.