CVE-2023-29527
Published: 19 April 2023
Summary
CVE-2023-29527 is a critical-severity Injection (CWE-74) vulnerability in Xwiki Xwiki. Its CVSS base score is 9.9 (Critical).
Operationally, ranked in the top 6.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
XWiki Platform, a generic wiki platform for building applications, contains an injection vulnerability tracked as CVE-2023-29527. A user lacking script or programming rights can still edit any document, including user profiles, using the wiki editor and insert Groovy script content. When the document is subsequently viewed, the server executes the injected Groovy code in its full runtime context, resulting in arbitrary code execution.
An authenticated attacker with only basic edit privileges can therefore achieve full server compromise, including reading or modifying sensitive data and executing commands with the privileges of the XWiki process. The attack requires no user interaction beyond saving and viewing the crafted page and is rated 9.9 under CVSS 3.1 because the script runs in a trusted server context.
Public advisories from the XWiki project and the associated GitHub security advisory state that the issue is resolved in versions 15.0-rc-1 and 14.10.3; administrators are advised to upgrade, and the project reports no known workarounds.
EPSS for the CVE has remained flat at its peak value of 0.0975 since disclosure, indicating no material increase in observed exploitation interest.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-1338
Vulnerability details
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions a user without script or programming right may edit a user profile (or any other document) with the wiki editor…
more
and add groovy script content. Viewing the document after saving it will execute the groovy script in the server context which provides code execution. This vulnerability has been patched in XWiki 15.0-rc-1 and 14.10.3. Users are advised to upgrade. There are no known workarounds for this issue.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Developer assessments and testing (including injection-focused techniques) identify improper neutralization of special elements, and the verifiable flaw remediation corrects them pre-deployment.
Identifies indicators of injection attacks (command, SQL, LDAP, etc.) via anomaly and attack monitoring.