CVE-2023-29514

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-29514
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-29514.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-29514
Aliases
Published
2023-04-18T23:48:12.348Z
Modified
2026-03-14T12:06:23.499070Z
Severity
  • 9.9 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
Summary
Code injection in template provider administration in xwiki-platform
Details

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with edit rights on any document (e.g., their own user profile) can execute code with programming rights, leading to remote code execution. This vulnerability has been patched in XWiki 13.10.11, 14.4.8, 14.10.1 and 15.0 RC1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-74"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/29xxx/CVE-2023-29514.json"
}
References

Affected packages

Git / github.com/xwiki/xwiki-platform

Affected ranges

Type
GIT
Repo
https://github.com/xwiki/xwiki-platform
Events
Introduced
ab4dfeaeef13360eebcaa507bc652073aa89a427
Fixed
08e0887f0362b21614e6bfcb5be7e1f568659c41

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-29514.json"