Description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with view rights can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of `Invitation.InvitationCommon`. This page is installed by default. The vulnerability has been patched in XWiki 15.0-rc-1, 14.10.1, 14.4.8, and 13.10.11. Users are advised to upgrade. There are no known workarounds for this issue.

Remediation

References

https://jira.xwiki.org/browse/XWIKI-20283

https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-px54-3w5j-qjg9

https://github.com/xwiki/xwiki-platform/commit/3d055a0a5ec42fdebce4d71ee98f94553fdbfebf

Related Vulnerabilities

CVE-2022-25842 Vulnerability in maven package com.alibaba.oneagent:one-java-agent-plugin

CVE-2018-3717 Vulnerability in npm package anywhere

CVE-2023-31125 Vulnerability in npm package engine.io

CVE-2019-19609 Vulnerability in npm package strapi

CVE-2020-22864 Vulnerability in npm package froala-editor

Severity

Critical

Classification

CWE-74 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Exploit Issue Tracking Patch Vendor Advisory