CVE-2023-37462
CriticalCVSS 9.9Exploitation Probability (EPSS)
Very high risk100th percentile - higher than 100% of all known CVEs
Summary
XWiki Platform has a vulnerability due to improper escaping in the `SkinsCode.XWikiSkinsSheet` document. This allows attackers to execute arbitrary script macros, including Groovy and Python, leading to remote code execution and unrestricted access to wiki content.
Risk Assessment
Organizations using XWiki are at serious risk, including the potential for remote code execution and unauthorized data access. Attackers could exploit this vulnerability to take control of the system.
Recommendation
It is recommended to upgrade to XWiki versions 14.4.8, 14.10.4, or 15.0-rc-1. Users unable to upgrade should manually patch the `SkinsCode.XWikiSkinsSheet` document according to the provided instructions.
Original NVD description (English source)
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Improper escaping in the document `SkinsCode.XWikiSkinsSheet` leads to an injection vector from view right on that document to programming rights, or in other words, it is possible to execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. The attack works by opening a non-existing page with a name crafted to contain a dangerous payload. It is possible to check if an existing installation is vulnerable. See the linked GHSA for instructions on testing an installation. This issue has been patched in XWiki 14.4.8, 14.10.4 and 15.0-rc-1. Users are advised to upgrade. The fix commit `d9c88ddc` can also be applied manually to the impacted document `SkinsCode.XWikiSkinsSheet` and users unable to upgrade are advised to manually patch their installations.