Vulnerability · Published Aug 17, 2023 · Assigned by GitHub_M
CVE-2023-37914Privilege escalation (PR)/RCE from account through Invitation subject/message
Critical 9.9
In plain English
A critical-severity code injection in xwiki-platform from xwiki. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.9% (higher than 79% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user who can view `Invitation.WebHome` can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. This vulnerability has been patched on XWiki 14.4.8, 15.2-rc-1, and 14.10.6. Users are advised to upgrade. Users unable to upgrade may manually apply the patch on `Invitation.InvitationCommon` and `Invitation.InvitationConfig`, but there are otherwise no known workarounds for this vulnerability.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.xwiki.platform:xwiki-platform-invitation-ui | 14.4.8 | GHSA-7954-6m9q-gpvf |
| Maven | org.xwiki.platform:xwiki-platform-invitation-ui | 14.10.6 | GHSA-7954-6m9q-gpvf |
| Maven | org.xwiki.platform:xwiki-platform-invitation-ui | 15.2-rc-1 | GHSA-7954-6m9q-gpvf |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| xwiki | xwiki-platform | >= 2.5-m1, < 14.4.8>= 14.5.0, < 14.10.6>= 15.0, < 15.2-rc-1 |
Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
References
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-7954-6m9q-gpvf x_refsource_CONFIRM
- https://github.com/xwiki/xwiki-platform/commit/ff1d8a1790c6ee534c6a4478360a06efeb2d3591 x_refsource_MISC
- https://jira.xwiki.org/browse/XWIKI-20421 x_refsource_MISC