CVE-2023-29512
Xwiki ≤ 13.10.11
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:LCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2023-29512 is a critical-severity Injection (CWE-74) vulnerability in Xwiki Xwiki. Its CVSS base score is 9.9 (Critical).
Operationally, ranked in the top 34% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
XWiki Platform contains a remote code execution vulnerability that affects the default-installed templates imported.vm, importinline.vm, and packagelist.vm. The root cause is insufficient escaping of data loaded from attachments, which permits any user holding edit rights on a page to inject and execute arbitrary Groovy, Python, or Velocity code. The flaw is tracked as CWE-74 and carries a CVSS 3.1 score of 9.9.
An attacker with the ability to edit any page, such as their own user profile, can upload a crafted attachment and trigger code execution that grants full control over the XWiki installation, including access to all content and server resources. Because the vulnerable templates are present by default, exploitation requires no additional configuration or elevated privileges beyond ordinary edit rights.
Official advisories and the XWiki security team recommend immediate upgrade to versions 15.0-rc-1, 14.10.1, 14.4.8, or 13.10.11; no workarounds are available. The associated EPSS score has remained stable at 0.2936 since disclosure.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-1323
Vulnerability Data
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with edit rights on a page (e.g., it's own user page), can execute arbitrary Groovy, Python or Velocity code in XWiki…
more
leading to full access to the XWiki installation. The root cause is improper escaping of the information loaded from attachments in `imported.vm`, `importinline.vm`, and `packagelist.vm`. This page is installed by default. This vulnerability has been patched in XWiki 15.0-rc-1, 14.10.1, 14.4.8, and 13.10.11. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Developer assessments and testing (including injection-focused techniques) identify improper neutralization of special elements, and the verifiable flaw remediation corrects them pre-deployment.
Identifies indicators of injection attacks (command, SQL, LDAP, etc.) via anomaly and attack monitoring.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Logging supports detection of injection attempts but does not prevent the weakness.
Monitoring activities can identify active injection attacks after they occur.
A.8.25 mandates a secure SDLC process that includes secure coding guidelines, security requirements, checkpoints, testing (scans/penetration), and developer training to reduce injection flaws, but does not itself enforce or guarantee neutralization of special elements at runtime.
Application security requirements explicitly call for controls against injection attacks in software design.
A.8.27 mandates security-by-design principles (including distrust external input, data validation/sanitization, secure architecture layers, and design reviews against attack patterns) that reach injection when applied to output construction; this stops exploitation for a minority slice (e.g. where principles drive sanitization) but leaves most code-level injection defects untouched without further implementation rigor.
Secure coding standards require proper neutralization of special elements, directly addressing CWE-74.
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.
- No fine-grained STIG row for CWE-74, a class-level weakness, and none of its children carries one either.