CVSS: 9.9EPSS: 0%CPEs: 2EXPL: 2CVE-2023-29522 – Code injection from view right on XWiki.ClassSheet in xwiki-platform
https://notcve.org/view.php?id=CVE-2023-29522
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with view rights can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. The attack works by opening a non-existing page with a name crafted to contain a dangerous payload. This issue has been patched in XWiki 14.4.8, 14.10.3 and 15.0RC1. Users are advised to upgrade. • https://github.com/xwiki/xwiki-platform/commit/d7e56185376641ee5d66477c6b2791ca8e85cfee https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-mjw9-3f9f-jq2w https://jira.xwiki.org/browse/XWIKI-20456 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 2CVE-2023-29521 – Code injection from account/view through VFS Tree macro in xwiki-platform
https://notcve.org/view.php?id=CVE-2023-29521
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with view rights can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of `Macro.VFSTreeMacro`. This page is not installed by default.This vulnerability has been patched in XWiki 15.0-rc-1, 14.10.2, 14.4.8, 13.10.11. Users are advised to upgrade. • https://github.com/xwiki/xwiki-platform/commit/fad02328f5ec7ab7fe5b932ffb5bc5c1ba7a5b12 https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-p67q-h88v-5jgr https://jira.xwiki.org/browse/XWIKI-20260 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 2CVE-2023-29520 – Page render failure due to broken translations in xwiki-platform
https://notcve.org/view.php?id=CVE-2023-29520
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to break many translations coming from wiki pages by creating a corrupted document containing a translation object. This will lead to a broken page. The vulnerability has been patched in XWiki 15.0-rc-1, 14.10.1, 14.4.8, and 13.10.11. Users are advised to upgrade. • https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-9jq5-xwqw-q8j3 https://jira.xwiki.org/browse/XWIKI-20460 • CWE-248: Uncaught Exception CWE-755: Improper Handling of Exceptional Conditions •
CVSS: 9.0EPSS: 0%CPEs: 3EXPL: 2CVE-2023-29519 – Code injection in org.xwiki.platform:xwiki-platform-attachment-ui
https://notcve.org/view.php?id=CVE-2023-29519
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A registered user can perform remote code execution leading to privilege escalation by injecting the proper code in the "property" field of an attachment selector, as a gadget of their own dashboard. Note that the vulnerability does not impact comments of a wiki. The vulnerability has been patched in XWiki 13.10.11, 14.4.8, 14.10.2, 15.0-rc-1. Users are advised to upgrade. • https://github.com/xwiki/xwiki-platform/commit/5e8725b4272cd3e5be09d3ca84273be2da6869c1 https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-3hjg-cghv-22ww https://jira.xwiki.org/browse/XWIKI-20364 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 9.9EPSS: 0%CPEs: 3EXPL: 2CVE-2023-29518 – Code injection from view right using Invitation.InvitationCommon in xwiki-platform
https://notcve.org/view.php?id=CVE-2023-29518
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with view rights can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of `Invitation.InvitationCommon`. This page is installed by default. The vulnerability has been patched in XWiki 15.0-rc-1, 14.10.1, 14.4.8, and 13.10.11. • https://github.com/xwiki/xwiki-platform/commit/3d055a0a5ec42fdebce4d71ee98f94553fdbfebf https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-px54-3w5j-qjg9 https://jira.xwiki.org/browse/XWIKI-20283 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •