Patchfirst
Patchfirst
CVE-2023-29516 Critical · 9.9 EPSS 65.9%

Code injection from view right on XWiki.AttachmentSelector in xwiki-platform

xwiki · xwiki-platform

Official description · CVE.org

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with view rights on `XWiki.AttachmentSelector` can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping in the "Cancel and return to page" button. This page is installed by default. This vulnerability has been patched in XWiki 15.0-rc-1, 14.10.1, 14.4.8, and 13.10.11. There are no known workarounds for this vulnerability.

Breakdown
26.8 / 100
Exploited
Not confirmed
Reports
0
Tactics
0/15

Disclosed on 18 Apr 2023. No public exploit code or confirmed exploitation is recorded.

2 related vulnerabilities in the same code on the same day. The latest fix listed for xwiki-platform-attachment-ui is 14.10.2.

Linked vulnerabilitiesLinked by evidence that a fix failed or the same code was patched again. Oldest first.

  1. This CVECVE-2023-29516Code injection from view right on XWiki.AttachmentSelector in…18 Apr 2023
  2. relatedHigh

    Why these are linked:

    • Fixed one release later14.10.1 → 14.10.2 (org.xwiki.platform:xwiki-platform-attachment-ui)
    • Same code patched: AttachmentSelector.xml (machine-matched)commit aca1d67commit 5e8725b
    CVE-2023-29519Code injection in…18 Apr 2023

Fixes in xwiki-platform-attachment-uiMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

  1. 14.4-rc-1CVE-2022-360978 Sep 2022
  2. 14.4.2CVE-2022-4192823 Nov 2022
  3. 14.10.1CVE-2023-2951618 Apr 2023
  4. 14.10.2CVE-2023-2951918 Apr 2023Latest listed

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: org.xwiki.platform:xwiki-platform-attachment-ui.

Mavenorg.xwiki.platform:xwiki-platform-attachment-uiGHSA-3989-4c6x-725f

Upgrade to 14.10.1 or later

Set the version to 14.10.1 or later in your pom.xml or build.gradle.

The first fix for CVE-2023-29516.

Affected versions, by release line

If you runUpgrade to
14.5 up to 14.10.114.10.1
14.0-rc-1 up to 14.4.814.4.8
2.0-rc-2 up to 13.10.1113.10.11

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

3 links, grouped by NVD tag

x_refsource_CONFIRM 1

github.com/xwiki/xwiki-platform/security/advisories/GHSA-3989-4c6x-725f

x_refsource_MISC 2

github.com/xwiki/xwiki-platform/commit/aca1d677c58563bbe6e35c9e1c29fd8b12ebb996jira.xwiki.org/browse/XWIKI-20275
↑ ↓ chooseEnter openEsc close