CVE-2023-29523

Deeper analysis

XWiki Platform contains an improper neutralization of special elements in output used by a downstream component vulnerability that permits script macro execution. Any user able to edit their own profile can invoke arbitrary Groovy or Python macros through the profile page or via the display method on documents, including those generated by the App Within Minutes application. The flaw affects all versions prior to the listed patches and carries a CVSS 3.1 score of 9.9 with network attack vector and low complexity.

An authenticated attacker with only profile-edit rights can achieve remote code execution, obtaining unrestricted read and write access to all wiki contents and potentially pivoting to the underlying host. The same vector can be triggered indirectly when application pages render user-controlled fields containing wiki syntax, expanding the attack surface beyond direct profile modification.

Official advisories and the XWiki security notice state there is no workaround and direct operators to upgrade to 13.10.11, 14.4.8, 14.10.2, or 15.0RC1. The referenced GitHub advisory and commit confirm the root cause was insufficient escaping of macro content in user-editable fields and document display routines.

EPSS rose from lower values to a peak of 0.1505 before settling at the current 0.1058, indicating measurable post-disclosure exploitation interest that warrants renewed attention for unpatched instances.