CVE-2023-36468
CriticalCVSS 9.9Exploitation Probability (EPSS)
Elevated risk73th percentile - higher than 73% of all known CVEs
Summary
A vulnerability in XWiki Platform allows remote code execution even after upgrading to a version that includes fixes. The issue arises when old document versions containing vulnerabilities are not removed from history, allowing for their reuse.
Risk Assessment
This vulnerability threatens the confidentiality, integrity, and availability of the entire XWiki installation, potentially leading to serious security breaches within the organization.
Recommendation
It is recommended to upgrade to XWiki version 14.10.7 or 15.2RC1 and manually delete old document versions to minimize risk. A script can also be used to identify and remove document history.
Other vulnerabilities in XWiki Platform
See all- CVE-2026-33137Critical
A vulnerability in XWiki Platform versions starting with 15.10.6 and prior to 18.1.0-rc-1, 17.10.3, 17.4.9, and 16.10.17. The POST /wikis/{wikiName} API performs a XAR import without authentication or authorization checks, allowing an unauthenticated attacker to create or update documents in the target wiki.
- CVE-2026-23734Critical
A vulnerability in XWiki Platform allows reading configuration files by manipulating the resource parameter in ssx and jsx endpoints, leading to Path Traversal. Affects versions prior to 18.1.0-rc-1, 17.10.3, 17.4.9, and 16.10.17.
- CVE-2026-33229Critical
XWiki Platform is a wiki platform. Prior to versions 17.4.8 and 17.10.1, an improperly protected scripting API allows users with script right to bypass the Velocity sandbox and execute arbitrary Python scripts, leading to full access to the XWiki instance.
- CVE-2023-40573Critical
XWiki Platform has a vulnerability that allows remote code execution by an attacker with edit rights on the wiki. It exploits a flaw in the job scheduler and an issue with content author authorization. This vulnerability has been patched in XWiki versions 14.10.9 and 15.4RC1.
- CVE-2023-40572Critical
XWiki Platform is vulnerable to a CSRF attack in the create action, allowing remote code execution by users with appropriate permissions. If a user with script rights sees a specific log message, the XWiki installation is at risk.
- CVE-2023-40177Critical
XWiki Platform allows registered users to execute arbitrary scripts in the content field of their profile page, leading to rights escalation. This issue has been present since version 4.3M2 when support for the content field was added in the AppWithinMinutes application.
- CVE-2023-40176Critical
XWiki Platform has a stored XSS vulnerability that can be exploited by registered users by setting a malicious payload in the time zone user preference. Although the time zone is selected from a dropdown, it can still be set using JavaScript or the appropriate URL.
- CVE-2023-37914Critical
XWiki Platform allows users who can view `Invitation.WebHome` to execute arbitrary script macros, including Groovy and Python, leading to remote code execution. This vulnerability allows unrestricted read and write access to all wiki contents.
- CVE-2023-37462Critical
XWiki Platform has a vulnerability due to improper escaping in the `SkinsCode.XWikiSkinsSheet` document. This allows attackers to execute arbitrary script macros, including Groovy and Python, leading to remote code execution and unrestricted access to wiki content.
- CVE-2023-37277Critical
XWiki Platform has a vulnerability that allows remote code execution via a cross-site request forgery (CSRF) attack using the REST API. Exploitation of this flaw by a user with programming rights can impact the integrity, availability, and confidentiality of the entire XWiki installation.
Original NVD description (English source)
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When an XWiki installation is upgraded and that upgrade contains a fix for a bug in a document, just a new version of that document is added. In some cases, it's still possible to exploit the vulnerability that was fixed in the new version. The severity of this depends on the fixed vulnerability, for the purpose of this advisory take CVE-2022-36100/GHSA-2g5c-228j-p52x as example - it is easily exploitable with just view rights and critical. When XWiki is upgraded from a version before the fix for it (e.g., 14.3) to a version including the fix (e.g., 14.4), the vulnerability can still be reproduced by adding `rev=1.1` to the URL used in the reproduction steps so remote code execution is possible even after upgrading. Therefore, this affects the confidentiality, integrity and availability of the whole XWiki installation. This vulnerability also affects manually added script macros that contained security vulnerabilities that were later fixed by changing the script macro without deleting the versions with the security vulnerability from the history. This vulnerability doesn't affect freshly installed versions of XWiki. Further, this vulnerability doesn't affect content that is only loaded from the current version of a document like the code of wiki macros or UI extensions. This vulnerability has been patched in XWiki 14.10.7 and 15.2RC1 by forcing old revisions to be executed in a restricted mode that disables all script macros. As a workaround, admins can manually delete old revisions of affected documents. A script could be used to identify all installed documents and delete the history for them. However, also manually added and later corrected code may be affected by this vulnerability so it is easy to miss documents.