CVE-2023-29509

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-29509
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-29509.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-29509
Aliases
Published
2023-04-16T07:04:17.561Z
Modified
2026-04-02T08:54:34.994859Z
Severity
  • 9.9 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
Summary
org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability
Details

XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with view rights on commonly accessible documents can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of the documentTree macro parameters in This macro is installed by default in FlamingoThemesCode.WebHome. This page is installed by default. The vulnerability has been patched in XWiki 13.10.11, 14.4.7 and 14.10.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/29xxx/CVE-2023-29509.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-95"
    ]
}
References

Affected packages

Git / github.com/xwiki/xwiki-platform

Affected ranges

Type
GIT
Repo
https://github.com/xwiki/xwiki-platform
Events
Introduced
470936d8edd6c570a462766d42ae361951d7bec9
Fixed
08e0887f0362b21614e6bfcb5be7e1f568659c41
Database specific 
{
    "versions": [
        {
            "introduced": "7.2-rc-1"
        },
        {
            "fixed": "13.10.11"
        }
    ]
}
Type
GIT
Repo
https://github.com/xwiki/xwiki-platform
Events
Introduced
198ef99386911c0f7af11a0957092d349961e3a6
Fixed
962ee4ac0352ab1a89cc779c29e81b0674d0203e
Database specific 
{
    "versions": [
        {
            "introduced": "14.0-rc-1"
        },
        {
            "fixed": "14.4.7"
        }
    ]
}
Type
GIT
Repo
https://github.com/xwiki/xwiki-platform
Events
Introduced
ab4dfeaeef13360eebcaa507bc652073aa89a427
Fixed
c524887d154ff8f6df9651e36b904e234bf5a6ef
Database specific 
{
    "versions": [
        {
            "introduced": "14.5"
        },
        {
            "fixed": "14.10"
        }
    ]
}

Affected versions

xwiki-platform-14.*
xwiki-platform-14.0
xwiki-platform-14.0-rc-1
xwiki-platform-14.5
xwiki-platform-7.*
xwiki-platform-7.2-rc-1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-29509.json"