CVE-2023-37914
CriticalCVSS 9.9Exploitation Probability (EPSS)
Elevated risk72th percentile - higher than 72% of all known CVEs
Summary
XWiki Platform allows users who can view `Invitation.WebHome` to execute arbitrary script macros, including Groovy and Python, leading to remote code execution. This vulnerability allows unrestricted read and write access to all wiki contents.
Risk Assessment
Organizations may face serious security threats, including unauthorized data access and the potential for malicious code injection. Exploitation of this vulnerability could lead to loss of data integrity and confidentiality.
Recommendation
It is recommended to upgrade to XWiki version 14.4.8, 15.2-rc-1, or 14.10.6. Users unable to upgrade should manually apply patches on `Invitation.InvitationCommon` and `Invitation.InvitationConfig`.
Original NVD description (English source)
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user who can view `Invitation.WebHome` can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. This vulnerability has been patched on XWiki 14.4.8, 15.2-rc-1, and 14.10.6. Users are advised to upgrade. Users unable to upgrade may manually apply the patch on `Invitation.InvitationCommon` and `Invitation.InvitationConfig`, but there are otherwise no known workarounds for this vulnerability.