CVE-2023-36469
CVSS 3.1 Score 8.8 of 10 (high)
Details
Summary
CVE-2023-36469 is a critical vulnerability affecting the XWiki Platform, a wiki solution that offers runtime services for various applications. This issue permits any user with the ability to edit their profile and notification settings to execute arbitrary script macros, including Groovy and Python, leading to remote code execution and unrestricted access to all wiki content. XWiki versions 14.10.5 and earlier, as well as 15.2RC1 and below, are vulnerable. Users are urged to update to the patched versions, XWiki 14.10.6 and 15.2RC1, as soon as possible. As a temporary solution, the main security fix can be manually applied by patching the `XWiki.Notifications.Code.NotificationRSSService` document. This approach, however, breaks the link to differences and necessitates additional changes to Velocity templates. The template for mentions, which is contained in a `.jar`-file, cannot be fixed without replacing the entire file.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Products
- Xwiki
Affected Vendors
- xwiki
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions