CVE-2023-29527 — Vulnerability in...

CRITICAL

XWiki Platform vulnerable to code injection from account through AWM view sheet

Published April 20, 2023Updated November 8, 2023Source: osv

Summary

### Impact Steps to reproduce: 1. As a user without script or programming right, edit your user profile (or any other document) with the wiki editor and add the content `{{groovy}}println("Hello " + "from Groovy!"){{/groovy}}` 1. Edit the document with the object editor and add an object of type AppWithinMinutes.LiveTableClass (no values need to be set, just save) 1. View the document ### Patches The vulnerability has been patched in XWiki 15.0-rc-1 and 14.10.3. ### Workarounds There is no known workaround. ### References https://jira.xwiki.org/browse/XWIKI-20423 ### For more information If you have any questions or comments about this advisory: * Open an issue in [Jira XWiki.org](https://jira.xwiki.org/) * Email us at [Security Mailing List](mailto:security@xwiki.org)

Advisory Timeline

First published April 20, 2023 (1271 days ago).
Last revised November 8, 2023 — 201 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Maven

Update org.xwiki.platform:xwiki-platform-appwithinminutes-ui to 14.10.3 or later

<!-- Update pom.xml dependency version to 14.10.3 for org.xwiki.platform:xwiki-platform-appwithinminutes-ui -->

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (1)

Affects 1 ecosystem: maven (1).

Package	Ecosystem	Affected	Fixed In
org.xwiki.platform:xwiki-platform-appwithinminutes-ui	maven	All versions	14.10.3

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-74
View on MITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.9 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2023-29527?: XWiki Platform vulnerable to code injection from account through AWM view sheet This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.9/10).
How do I check if my project is affected by CVE-2023-29527?: CVE-2023-29527 affects org.xwiki.platform:xwiki-platform-appwithinminutes-ui. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2023-29527 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

9.9

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-jgrg-qvpp-9vwr

Related CVEs

CVE-2023-35161
CRITICAL
XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in DeleteApplication page
CVE-2023-40177
CRITICAL
XWiki Platform privilege escalation (PR) from account through AWM content fields
CVE-2023-29514
CRITICAL
XWiki vulnerable to Code Injection in template provider administration
CVE-2023-36470
CRITICAL
XWiki Platform vulnerable to Code Injection in icon themes
CVE-2023-45134
CRITICAL
XWiki Platform XSS vulnerability from account in the create page form via template provider
CVE-2023-29207
HIGH
Improper Neutralization of Script-Related HTML Tags (XSS) in the LiveTable Macro
CVE-2025-49582
HIGH
XWiki's required right warnings for macros are incomplete
CVE-2025-66472
MEDIUM
XWiki vulnerable to a reflected XSS via xredirect parameter in DeleteApplication

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies