{"id":"CVE-2023-35150","published":"2023-06-23T16:26:55Z","modified":"2024-11-29T14:35:16Z","title":"XWiki Platform vulnerable to privilege escalation (PR) from view right via Invitation application","vendor":"xwiki","product":"xwiki-platform","tier":"core","eol":null,"affectedVersions":[{"vendor":"xwiki","product":"xwiki-platform","versions":[">= 2.4-m-2, < 14.4.8",">= 14.5, < 14.10.4"]}],"description":{"text":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 2.40m-2 and prior to versions 14.4.8, 14.10.4, and 15.0, any user with view rights on any document can execute code with programming rights, leading to remote code execution by crafting an url with a dangerous payload. The problem has been patched in XWiki 15.0, 14.10.4 and 14.4.8.","provenance":"source","from":"CVE.org"},"summary":{"text":"The XWiki Platform (xwiki-platform, the generic wiki runtime) contains an eval injection flaw in its Invitation application, which allows privilege escalation from view rights to programming rights. An attacker who has only view rights on a document, meaning a low-privileged authenticated user, can craft a URL containing a dangerous payload that is executed with programming rights, requiring no user interaction and only network access to the wiki.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:14:19Z"},"cvss":{"score":9.9,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.77654,"percentile":0.99563,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[{"id":"CWE-95","name":"Improper Neutralization of Directives in Dynamically Evaluated Code"}],"references":[{"url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-6mf5-36v9-3h2w","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/xwiki/xwiki-platform/commit/b65220a4d86b8888791c3b643074ebca5c089a3a","tags":["x_refsource_MISC"]},{"url":"https://jira.xwiki.org/browse/XWIKI-20285","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-invitation-ui","vulnerableRanges":[">=2.4-m-2, <14.4.8",">=14.5, <14.10.4",">=15.0-rc-1, <15.0"],"patched":["14.4.8","14.10.4","15.0"],"from":["GHSA-6mf5-36v9-3h2w"],"provenance":"source"}],"advisories":[{"id":"GHSA-6mf5-36v9-3h2w","url":"https://github.com/advisories/GHSA-6mf5-36v9-3h2w","severity":"CRITICAL","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-invitation-ui","vulnerableRanges":[">=2.4-m-2, <14.4.8"],"patched":["14.4.8"],"provenance":"source","from":"GHSA"},{"id":"GHSA-6mf5-36v9-3h2w","url":"https://github.com/advisories/GHSA-6mf5-36v9-3h2w","severity":"CRITICAL","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-invitation-ui","vulnerableRanges":[">=14.5, <14.10.4"],"patched":["14.10.4"],"provenance":"source","from":"GHSA"},{"id":"GHSA-6mf5-36v9-3h2w","url":"https://github.com/advisories/GHSA-6mf5-36v9-3h2w","severity":"CRITICAL","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-invitation-ui","vulnerableRanges":[">=15.0-rc-1, <15.0"],"patched":["15.0"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2023-1712","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-1712","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2023-06-23","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2023-35150","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":26.8,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.91,"detail":"percentile 0.9956"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.93,"detail":"base score 9.9"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-xwiki-platform-cve-2023-29518","parents":[{"from":"CVE-2023-29518","to":"CVE-2023-35150","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.xwiki.platform:xwiki-platform-invitation-ui","fromFixed":"14.10.1","toFixed":"14.10.4","daysApart":66},{"kind":"same-code","provenance":"machine","files":["xwiki-platform-core/xwiki-platform-invitation/xwiki-platform-invitation-ui/src/main/resources/Invitation/InvitationCommon.xml"],"commits":["https://github.com/xwiki/xwiki-platform/commit/3d055a0a5ec42fdebce4d71ee98f94553fdbfebf","https://github.com/xwiki/xwiki-platform/commit/b65220a4d86b8888791c3b643074ebca5c089a3a"],"basis":"rarely changed file"}]}],"children":[{"from":"CVE-2023-35150","to":"CVE-2023-37914","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.xwiki.platform:xwiki-platform-invitation-ui","fromFixed":"14.10.4","toFixed":"14.10.6","daysApart":55},{"kind":"version-step","provenance":"source","package":"Maven:org.xwiki.platform:xwiki-platform-invitation-ui","fromFixed":"15.0","toFixed":"15.2-rc-1","daysApart":55},{"kind":"same-code","provenance":"machine","files":["xwiki-platform-core/xwiki-platform-invitation/xwiki-platform-invitation-ui/src/main/resources/Invitation/InvitationCommon.xml","xwiki-platform-core/xwiki-platform-invitation/xwiki-platform-invitation-ui/src/main/resources/Invitation/InvitationConfig.xml"],"commits":["https://github.com/xwiki/xwiki-platform/commit/b65220a4d86b8888791c3b643074ebca5c089a3a","https://github.com/xwiki/xwiki-platform/commit/ff1d8a1790c6ee534c6a4478360a06efeb2d3591"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2023-29518","published":"2023-04-18","fixed":"14.10.1","kev":false},{"cve":"CVE-2023-35150","published":"2023-06-23","fixed":"15.0","kev":false},{"cve":"CVE-2023-37914","published":"2023-08-17","fixed":"15.2-rc-1","kev":false}],"package":"Maven:org.xwiki.platform:xwiki-platform-invitation-ui"}}