Patchfirst
Patchfirst
CVE-2023-36469 Critical · 10.0 EPSS 82.0%

Code injection through NotificationRSSService in XWiki Platform

xwiki · xwiki-platform

Summary

A code injection flaw in the NotificationRSSService component of XWiki Platform (xwiki-platform) allows script macros, including Groovy and Python macros, to be executed through the user profile and notification settings. An attacker needs only low-privilege authenticated access, specifically the ability to edit their own user profile and notification settings, with no user interaction required, and can then achieve remote code execution with unrestricted read and write access to all wiki contents.

Official description · CVE.org

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user who can edit their own user profile and notification settings can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. This has been patched in XWiki 14.10.6 and 15.2RC1. Users are advised to update. As a workaround the main security fix can be manually applied by patching the affected document `XWiki.Notifications.Code.NotificationRSSService`. This will break the link to the differences, though as this requires additional changes to Velocity templates as shown in the patch. While the default template is available in the instance and can be easily patched, the template for mentions is contained in a `.jar`-file and thus cannot be fixed without replacing that jar.

Breakdown
26.9 / 100
Exploited
Not confirmed
Reports
0
Tactics
0/15

Disclosed on 29 Jun 2023. No public exploit code or confirmed exploitation is recorded.

See the family tree

4 related vulnerabilities in the same code over 22 months. The latest fix listed for xwiki-platform-notifications-ui is 15.10.1.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

  1. CVE-2023-29207Improper Neutralization of Script-Related HTML Tags (XSS) in the…15 Apr 2023
  2. same family
    This CVECVE-2023-36469Code injection through NotificationRSSService in XWiki Platform29 Jun 2023
  3. same family
    CVE-2024-31982XWiki Platform: Remote code execution as guest via…10 Apr 2024
  4. relatedMedium

    Why these are linked:

    CVE-2025-24893XWiki Platform Eval Injection20 Feb 2025KEV

Fixes in xwiki-platform-notifications-uiMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

  1. 14.10CVE-2023-2921015 Apr 2023
  2. 15.2-rc-1CVE-2023-3646929 Jun 2023
  3. 15.10.1CVE-2024-4697818 Sep 2024
  4. 15.10.1CVE-2024-4697918 Sep 2024Latest listed

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: org.xwiki.platform:xwiki-platform-notifications-ui.

Mavenorg.xwiki.platform:xwiki-platform-notifications-uiGHSA-94pf-92hw-2hjc

Upgrade to 14.10.6

Also affected, despite being newer: 15.0-rc-1 up to 15.2-rc-1.

Set the version to 14.10.6 or later in your pom.xml or build.gradle.

The first fix for CVE-2023-36469. No other CVE tracked by Patchfirst affects this package.

Affected versions, by release line

If you runUpgrade to
15.0-rc-1 up to 15.2-rc-115.2-rc-1
9.6-rc-1 up to 14.10.614.10.6

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

3 links, grouped by NVD tag (2 duplicates merged)

x_refsource_CONFIRM 1

github.com/xwiki/xwiki-platform/security/advisories/GHSA-94pf-92hw-2hjc

x_refsource_MISC 2

github.com/xwiki/xwiki-platform/commit/217e5bb7a657f2991b154a16ef4d5ae9c29ad39cjira.xwiki.org/browse/XWIKI-20610
↑ ↓ chooseEnter openEsc close