XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Improper escaping in the document `SkinsCode.XWikiSkinsSheet` leads to an injection vector from view right on that document to programming rights, or in other words, it is possible to execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. The attack works by opening a non-existing page with a name crafted to contain a dangerous payload. It is possible to check if an existing installation is vulnerable. See the linked GHSA for instructions on testing an installation. This issue has been patched in XWiki 14.4.8, 14.10.4 and 15.0-rc-1. Users are advised to upgrade. The fix commit `d9c88ddc` can also be applied manually to the impacted document `SkinsCode.XWikiSkinsSheet` and users unable to upgrade are advised to manually patch their installations.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it.
    Improper escaping in the document `SkinsCode.XWikiSkinsSheet` leads to an injection vector from view right
    on that document to programming rights, or in other words, it is possible to execute arbitrary script
    macros including Groovy and Python macros that allow remote code execution including unrestricted read and
    write access to all wiki contents. The attack works by opening a non-existing page with a name crafted to
    contain a dangerous payload. It is possible to check if an existing installation is vulnerable. See the
    linked GHSA for instructions on testing an installation. This issue has been patched in XWiki 14.4.8,
    14.10.4 and 15.0-rc-1. Users are advised to upgrade. The fix commit `d9c88ddc` can also be applied
    manually to the impacted document `SkinsCode.XWikiSkinsSheet` and users unable to upgrade are advised to
    manually patch their installations. (CVE-2023-37462)

XWiki Platform versions 7.0, before 14.4.8 and versions 14.5 before 14.10.4 suffer from an improper escaping in the document 'SkinsCode.XWikiSkinsSheet'. By leveraging this vulnerability, a remote and unauthenticated attacker can achieve privilege escalation and achieve code execution on the vulnerable XWiki instance.

ID	Name	Product	Family	Severity
415473	SCA: security update for org.xwiki.platform:xwiki-platform-skin-ui (GHSA-h4vp-69r8-gvjg)	Tenable Cloud Security	SCA Checks	high
415473	SCA: security update for org.xwiki.platform:xwiki-platform-skin-ui (GHSA-h4vp-69r8-gvjg)	Tenable Self-Hosted Container Security	SCA Checks	high
114451	XWiki Platform 7.0 < 14.4.8 / 14.5 < 14.10.4 Remote Code Execution	Web App Scanning	Component Vulnerability	high

Detections

Analytics

CVE-2023-37462

high

Tenable Plugins

high

high

high