CVE-2023-35150
published 2023-06-23CVE-2023-35150: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 2.40m-2 and prior to versions…
PriorityP268high8CVSS 3.1
AVNACLPRLUIRSUCHIHAH
EPSS
77.65%
99.5th percentile
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 2.40m-2 and prior to versions 14.4.8, 14.10.4, and 15.0, any user with view rights on any document can execute code with programming rights, leading to remote code execution by crafting an url with a dangerous payload. The problem has been patched in XWiki 15.0, 14.10.4 and 14.4.8.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| xwiki | xwiki | — | — |
| xwiki | xwiki | >= 14.10 < 14.10.4 | 14.10.4 |
| xwiki | xwiki | >= 2.5 < 14.4.8 | 14.4.8 |
| xwiki | xwiki-platform | — | — |
| xwiki | xwiki-platform | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
XWiki Platform vulnerable to privilege escalation (PR) from view right via Invitation application
ghsa·2023-06-20
CVE-2023-35150 [CRITICAL] CWE-94 XWiki Platform vulnerable to privilege escalation (PR) from view right via Invitation application
XWiki Platform vulnerable to privilege escalation (PR) from view right via Invitation application
### Impact
Any user with view rights on any document can execute code with programming rights, leading to remote code execution by crafting an url with a dangerous payload. See the example below:
Open `/xwiki/bin/view/%5D%5D%20%7B%7Basync%20async%3D%22true%22%20cached%3D%22false%22%20context%3D%22doc.reference%22%7D%7D%7B%7Bgroovy%7D%7Dprintln(%22Hello%20%22%20%2B%20%22from%20groovy!%22)%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fasync%7D%7D?sheet=Invitation.InvitationGuestActions&xpage=view` where `` is the URL of your XWiki installation.
### Patches
The problem as been patching on XWiki 15.0, 14.10.4 and 14.4.8.
### Workarounds
It is possible to partially fix the issue by applying this [patch](https://
OSV
XWiki Platform vulnerable to privilege escalation (PR) from view right via Invitation application
osv·2023-06-20
CVE-2023-35150 [CRITICAL] XWiki Platform vulnerable to privilege escalation (PR) from view right via Invitation application
XWiki Platform vulnerable to privilege escalation (PR) from view right via Invitation application
### Impact
Any user with view rights on any document can execute code with programming rights, leading to remote code execution by crafting an url with a dangerous payload. See the example below:
Open `/xwiki/bin/view/%5D%5D%20%7B%7Basync%20async%3D%22true%22%20cached%3D%22false%22%20context%3D%22doc.reference%22%7D%7D%7B%7Bgroovy%7D%7Dprintln(%22Hello%20%22%20%2B%20%22from%20groovy!%22)%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fasync%7D%7D?sheet=Invitation.InvitationGuestActions&xpage=view` where `` is the URL of your XWiki installation.
### Patches
The problem as been patching on XWiki 15.0, 14.10.4 and 14.4.8.
### Workarounds
It is possible to partially fix the issue by applying this [patch](https://
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/xwiki/xwiki-platform/commit/b65220a4d86b8888791c3b643074ebca5c089a3ahttps://github.com/xwiki/xwiki-platform/security/advisories/GHSA-6mf5-36v9-3h2whttps://jira.xwiki.org/browse/XWIKI-20285https://github.com/xwiki/xwiki-platform/commit/b65220a4d86b8888791c3b643074ebca5c089a3ahttps://github.com/xwiki/xwiki-platform/security/advisories/GHSA-6mf5-36v9-3h2whttps://jira.xwiki.org/browse/XWIKI-20285
2023-06-23
Published