CVE-2023-40573
CriticalCVSS 9.0Exploitation Probability (EPSS)
Elevated risk58th percentile - higher than 58% of all known CVEs
Summary
XWiki Platform has a vulnerability that allows remote code execution by an attacker with edit rights on the wiki. It exploits a flaw in the job scheduler and an issue with content author authorization. This vulnerability has been patched in XWiki versions 14.10.9 and 15.4RC1.
Risk Assessment
The organization is at risk of remote code execution, which can lead to serious security breaches and data loss. Attackers with edit rights can exploit this vulnerability to gain control over the system.
Recommendation
It is recommended to upgrade to XWiki versions 14.10.9 or 15.4RC1 to mitigate this vulnerability. Additionally, conducting a user permissions audit to limit editing capabilities is advisable.
Original NVD description (English source)
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki supports scheduled jobs that contain Groovy scripts. Currently, the job checks the content author of the job for programming right. However, modifying or adding a job script to a document doesn't modify the content author. Together with a CSRF vulnerability in the job scheduler, this can be exploited for remote code execution by an attacker with edit right on the wiki. If the attack is successful, an error log entry with "Job content executed" will be produced. This vulnerability has been patched in XWiki 14.10.9 and 15.4RC1.