CVE-2023-29526

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible to display or interact with any page a user cannot access through the combination of the async and display macros. A comment with either macro will be executed when viewed providing a code injection vector in the context of the running server. This vulnerability has been patched in XWiki 15.0-rc-1, 14.10.3, 14.4.8, and 13.10.11. Users are advised to upgrade. There are no known workarounds for this issue.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74

Affected software

Vendor	Product	Versions
xwiki	xwiki-platform	>= 10.11.1, < 13.10.11; >= 14.0.0, < 14.4.8; >= 14.5.0, < 14.10.3

References

https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-gpq5-7p34-vqx5Exploit, Vendor Advisory
https://jira.xwiki.org/browse/XRENDERING-694Exploit, Issue Tracking, Patch, Vendor Advisory
https://jira.xwiki.org/browse/XWIKI-20394Exploit, Issue Tracking, Patch, Vendor Advisory
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-gpq5-7p34-vqx5Exploit, Vendor Advisory
https://jira.xwiki.org/browse/XRENDERING-694Exploit, Issue Tracking, Patch, Vendor Advisory
https://jira.xwiki.org/browse/XWIKI-20394Exploit, Issue Tracking, Patch, Vendor Advisory

Timeline

Published: Apr 19, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-295278.8XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions a user without CVE-2023-295289.0XWiki Commons are technical libraries common to several other top level XWiki projects. The "restricted" mode of the HTML cleaner in XWiki, CVE-2023-295295.3matrix-js-sdk is the Matrix Client-Server SDK for JavaScript and TypeScript. An attacker present in a room where an MSC3401 group call is ta CVE-2023-29537.5A vulnerability was found in openldap. This security flaw causes a null pointer dereference in ber_memalloc_x() function.CVE-2023-295306.5Laminas Diactoros provides PSR HTTP Message implementations. In versions 2.18.0 and prior, 2.19.0, 2.20.0, 2.21.0, 2.22.0, 2.23.0, 2.24.0, a CVE-2023-295319.8An attacker could have caused an out of bounds memory access using WebGL APIs, leading to memory corruption and a potentially exploitable cr CVE-2023-295325.5A local attacker can trick the Mozilla Maintenance Service into applying an unsigned update file by pointing the service at an update file o CVE-2023-295334.3A website could have obscured the fullscreen notification by using a combination of <code>window.open</code>, fullscreen requests, <code>win CVE-2023-295349.1Different techniques existed to obscure the fullscreen notification in Firefox and Focus for Android. These could have led to potential use CVE-2023-295356.5Following a Garbage Collector compaction, weak maps may have been accessed before they were correctly traced. This resulted in memory corrup CVE-2023-295368.8An attacker could cause the memory manager to incorrectly free a pointer that addresses attacker-controlled memory, resulting in an assertio CVE-2023-295377.5Multiple race conditions in the font initialization could have led to memory corruption and execution of attacker-controlled code. This vuln