{"id":"CVE-2023-29525","published":"2023-04-18T23:01:46Z","modified":"2025-02-05T19:04:44Z","title":"Privilege escalation from view right on XWiki.Notifications.Code.LegacyNotificationAdministration in xwiki-platform","vendor":"xwiki","product":"xwiki-platform","tier":"core","eol":null,"affectedVersions":[{"vendor":"xwiki","product":"xwiki-platform","versions":["< 14.4.8",">= 14.5.0, < 14.10.3."]}],"description":{"text":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Affected versions of xwiki are subject to code injection in the `since` parameter of the `/xwiki/bin/view/XWiki/Notifications/Code/LegacyNotificationAdministration` endpoint. This provides an XWiki syntax injection attack via the since-parameter, allowing privilege escalation from view to programming rights and subsequent code execution privilege. The vulnerability has been patched in XWiki 15.0-rc-1, 14.10.3, 14.4.8 and 14.10.3. Users are advised to upgrade. Users unable to upgrade may modify the page `XWiki.Notifications.Code.LegacyNotificationAdministration` to add the missing escaping. For versions < 14.6-rc-1 a workaround is to modify the file `<xwikiwebapp>/templates/distribution/eventmigration.wiki` to add the missing escaping.","provenance":"source","from":"CVE.org"},"summary":{"text":"A flaw in the since parameter of the /xwiki/bin/view/XWiki/Notifications/Code/LegacyNotificationAdministration endpoint in xwiki-platform (XWiki) allows injection of XWiki syntax into output. An attacker with network access and low-privilege (view-level) authentication, requiring no user interaction, can exploit it to escalate from view rights to programming rights and then run code.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:14:14Z"},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.77752,"percentile":0.99568,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[{"id":"CWE-74","name":"Improper Neutralization of Special Elements in Output Used by a Downstream Component"}],"references":[{"url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-jgg7-w2rj-58cj","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/xwiki/xwiki-platform/commit/6d74e2e4aa03d19f0be385ab63ae9e0f0e90a766","tags":["x_refsource_MISC"]},{"url":"https://github.com/xwiki/xwiki-platform/commit/8e7c7f90f2ddaf067cb5b83b181af41513028754#diff-4e13f4ee4a42938bf1201b7ee71ca32edeacba22559daf0bcb89d534e0225949R70","tags":["x_refsource_MISC"]},{"url":"https://jira.xwiki.org/browse/XWIKI-20287","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-distribution-war","vulnerableRanges":[">=12.6.1, <13.10.11",">=14.0-rc-1, <14.4.8",">=14.5, <14.6-rc-1"],"patched":["13.10.11","14.4.8","14.6-rc-1"],"from":["GHSA-jgg7-w2rj-58cj"],"provenance":"source"},{"ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-legacy-events-hibernate-ui","vulnerableRanges":[">=14.6-rc-1, <14.10.3"],"patched":["14.10.3"],"from":["GHSA-jgg7-w2rj-58cj"],"provenance":"source"}],"advisories":[{"id":"GHSA-jgg7-w2rj-58cj","url":"https://github.com/advisories/GHSA-jgg7-w2rj-58cj","severity":"CRITICAL","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-distribution-war","vulnerableRanges":[">=12.6.1, <13.10.11"],"patched":["13.10.11"],"provenance":"source","from":"GHSA"},{"id":"GHSA-jgg7-w2rj-58cj","url":"https://github.com/advisories/GHSA-jgg7-w2rj-58cj","severity":"CRITICAL","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-distribution-war","vulnerableRanges":[">=14.0-rc-1, <14.4.8"],"patched":["14.4.8"],"provenance":"source","from":"GHSA"},{"id":"GHSA-jgg7-w2rj-58cj","url":"https://github.com/advisories/GHSA-jgg7-w2rj-58cj","severity":"CRITICAL","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-distribution-war","vulnerableRanges":[">=14.5, <14.6-rc-1"],"patched":["14.6-rc-1"],"provenance":"source","from":"GHSA"},{"id":"GHSA-jgg7-w2rj-58cj","url":"https://github.com/advisories/GHSA-jgg7-w2rj-58cj","severity":"CRITICAL","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-legacy-events-hibernate-ui","vulnerableRanges":[">=14.6-rc-1, <14.10.3"],"patched":["14.10.3"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2023-1337","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-1337","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2023-04-18","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2023-29525","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":26.9,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.91,"detail":"percentile 0.9957"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":7.0,"detail":"base score 10"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"packageHistory":[{"cve":"CVE-2024-55663","published":"2024-12-12","fixed":"14.3-rc-1","kev":false},{"cve":"CVE-2023-29525","published":"2023-04-18","fixed":"14.6-rc-1","kev":false},{"cve":"CVE-2023-32071","published":"2023-05-09","fixed":"14.10.4","kev":false,"link":{"from":"CVE-2023-29525","to":"CVE-2023-32071","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.xwiki.platform:xwiki-platform-distribution-war","fromFixed":"14.6-rc-1","toFixed":"14.10.4","daysApart":21}]}},{"cve":"CVE-2024-21651","published":"2024-01-08","fixed":"15.8-rc-1","kev":false},{"cve":"CVE-2025-32429","published":"2025-07-24","fixed":"17.3.0-rc-1","kev":false}],"package":"Maven:org.xwiki.platform:xwiki-platform-distribution-war"}}