PT-2023-8610 · Xwiki · Xwiki Platform

Michael Hamann

·

CVE-2023-29518

·

Publicado

2023-04-18

·

Atualizado

2023-04-28

CVSS v3.1

9.9

Crítica

VetorAV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
Name of the Vulnerable Software and Affected Versions XWiki Platform versions prior to 13.10.11 XWiki Platform versions prior to 14.4.8 XWiki Platform versions prior to 14.10.1 XWiki Platform versions prior to 15.0-rc-1
Description The issue exists due to improper escaping of Invitation.InvitationCommon, allowing any user with view rights to execute arbitrary Groovy, Python, or Velocity code, leading to full access to the XWiki installation. This page is installed by default.
Recommendations For versions prior to 13.10.11, upgrade to version 13.10.11 or later. For versions prior to 14.4.8, upgrade to version 14.4.8 or later. For versions prior to 14.10.1, upgrade to version 14.10.1 or later. For versions prior to 15.0-rc-1, upgrade to version 15.0-rc-1 or later. As a temporary workaround, consider applying the patch on Invitation.InvitationCommon to fix the issue.

Exploit

Correção

DoS

Special Elements Injection

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-74

Identificadores relacionados

BDU:2024-01263
CVE-2023-29518
GHSA-PX54-3W5J-QJG9

Produtos afetados

Xwiki Platform