CVE-2023-29514
Published: 19 April 2023
Summary
CVE-2023-29514 is a critical-severity Injection (CWE-74) vulnerability in Xwiki Xwiki. Its CVSS base score is 9.9 (Critical).
Operationally, ranked in the top 3.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
XWiki Platform, a generic wiki platform, contains an injection vulnerability tracked as CVE-2023-29514 that permits any user possessing edit rights on a document to execute code under programming rights. The flaw stems from insufficient validation of user-controlled content, allowing server-side code execution and resulting in full remote code execution on the host.
An authenticated attacker with minimal privileges, such as the ability to edit their own user profile, can craft malicious content that is evaluated with elevated rights, leading to arbitrary command execution, data exfiltration, or persistence within the XWiki instance. The CVSS 9.9 score reflects the network-accessible, low-complexity nature of the attack combined with its impact across confidentiality, integrity, and availability in a multi-tenant context.
Official advisories and the linked GitHub security notice state that the issue is resolved in XWiki releases 13.10.11, 14.4.8, 14.10.1, and 15.0 RC1; administrators are directed to upgrade, as no workarounds are available. The current EPSS score of 0.3022 has remained flat at its observed peak, indicating steady but not sharply increasing exploitation interest since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-1251
Vulnerability details
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with edit rights on any document (e.g., their own user profile) can execute code with programming rights, leading to remote code…
more
execution. This vulnerability has been patched in XWiki 13.10.11, 14.4.8, 14.10.1 and 15.0 RC1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Developer assessments and testing (including injection-focused techniques) identify improper neutralization of special elements, and the verifiable flaw remediation corrects them pre-deployment.
Identifies indicators of injection attacks (command, SQL, LDAP, etc.) via anomaly and attack monitoring.