CVE-2023-35150
CriticalCVSS 9.9Exploitation Probability (EPSS)
Very high risk100th percentile - higher than 100% of all known CVEs
Summary
XWiki Platform, a popular wiki platform, has a vulnerability that allows users with view rights on documents to execute code with programming rights. Versions from 2.40m-2 up to but not including 14.4.8, 14.10.4, and 15.0 are susceptible to remote code execution via a specially crafted URL.
Risk Assessment
Organizations using vulnerable versions of XWiki may be exposed to remote code execution, potentially leading to serious security breaches and data loss.
Recommendation
It is recommended to upgrade to XWiki versions 15.0, 14.10.4, or 14.4.8 to mitigate this security vulnerability.
Original NVD description (English source)
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 2.40m-2 and prior to versions 14.4.8, 14.10.4, and 15.0, any user with view rights on any document can execute code with programming rights, leading to remote code execution by crafting an url with a dangerous payload. The problem has been patched in XWiki 15.0, 14.10.4 and 14.4.8.