CVE-2023-36469
CriticalCVSS 9.9Exploitation Probability (EPSS)
Very high risk100th percentile - higher than 100% of all known CVEs
Summary
XWiki Platform allows users to edit their profiles and notification settings, enabling the execution of arbitrary script macros, including Groovy and Python, leading to remote code execution. Versions 14.10.6 and 15.2RC1 contain patches for this vulnerability.
Risk Assessment
Organizations may be exposed to remote code execution, leading to unauthorized access to all wiki content. This poses a serious threat to the integrity and confidentiality of data.
Recommendation
It is recommended to update to version 14.10.6 or 15.2RC1. Alternatively, the patch can be manually applied to the document `XWiki.Notifications.Code.NotificationRSSService`, but this requires additional changes to Velocity templates.
Original NVD description (English source)
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user who can edit their own user profile and notification settings can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. This has been patched in XWiki 14.10.6 and 15.2RC1. Users are advised to update. As a workaround the main security fix can be manually applied by patching the affected document `XWiki.Notifications.Code.NotificationRSSService`. This will break the link to the differences, though as this requires additional changes to Velocity templates as shown in the patch. While the default template is available in the instance and can be easily patched, the template for mentions is contained in a `.jar`-file and thus cannot be fixed without replacing that jar.