Vulnerability Details : CVE-2023-29210
Potential exploit
XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with view rights on commonly accessible documents including the notification preferences macros can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of the user parameter of the macro that provide the notification filters. These macros are used in the user profiles and thus installed by default in XWiki. The vulnerability has been patched in XWiki 13.10.11, 14.4.7 and 14.10.
Products affected by CVE-2023-29210
- cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*
- cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*
- cpe:2.3:a:xwiki:xwiki:14.10:rc1:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2023-29210
8.21%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 92 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2023-29210
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
8.8
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
2.8
|
5.9
|
NIST | |
|
9.9
|
CRITICAL | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
3.1
|
6.0
|
GitHub, Inc. |
CWE ids for CVE-2023-29210
-
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.Assigned by: nvd@nist.gov (Primary)
-
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").Assigned by: security-advisories@github.com (Secondary)
References for CVE-2023-29210
-
https://jira.xwiki.org/browse/XWIKI-20259
[XWIKI-20259] Privilege escalation (PR) from account/view through Notification Preferences Macros - XWiki.org JIRAExploit;Issue Tracking
-
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-p9mj-v5mf-m82x
Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in org.xwiki.platform:xwiki-platform-notifications-ui · Advisory · xwiki/xwiki-platform · GitHubExploit;Patch;Vendor Advisory
-
https://github.com/xwiki/xwiki-platform/commit/cebf9167e4fd64a8777781fc56461e9abbe0b32a
XWIKI-20259: Improve escaping in Notification Preferences Macros · xwiki/xwiki-platform@cebf916 · GitHubPatch
Jump to