XWiki Platform vulnerable to code injection from account/view through VFS Tree macro

高 8.8CVE-2023-29521 · GHSA-p67q-h88v-5jgr · 19/04/2023 公開 · 17/06/2026 更新

要点

CVE-2023-29521 は org.xwiki.platform:xwiki-platform-vfs-ui, xwiki (xwiki) に影響する深刻度「高」 (CVSS 8.8) の脆弱性です。
今後30日間に悪用される確率（EPSS）：1.1%（全脆弱性の 66.5% より高い）。
対処：14.4.8, 14.10.2, 13.10.11 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
org.xwiki.platform:xwiki-platform-vfs-ui Maven	`≥ 14.0-rc-1, < 14.4.8≥ 14.5, < 14.10.2≥ 7.4-milestone-2, < 13.10.11`	`14.4.814.10.213.10.11`
xwiki xwiki	`≥ 14.0, < 14.4.8≥ 14.5, < 14.10.2< 13.10.11`	`14.4.814.10.213.10.11`

概要

Impact

Any user with view rights can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of Macro.VFSTreeMacro. This page is not installed by default.

See https://jira.xwiki.org/browse/XWIKI-20260 for the reproduction steps.

Patches

The vulnerability has been patched in XWiki 15.0-rc-1, 14.10.2, 14.4.8, 13.10.11.

Workarounds

The issue can be fixed by applying this patch on Macro.VFSTreeMacro.

References

For more information

If you have any questions or comments about this advisory:

Open an issue in Jira XWiki.org
Email us at Security Mailing List

NVD の説明

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with view rights can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of `Macro.VFSTreeMacro`. This page is not installed by default.This vulnerability has been patched in XWiki 15.0-rc-1, 14.10.2, 14.4.8, 13.10.11. Users are advised to upgrade. There are no known workarounds for this vulnerability.