CVE-2023-30537

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with the right to add an object on a page can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of the styles properties `FlamingoThemesCode.WebHome`. This page is installed by default. The vulnerability has been patched in XWiki versions 13.10.11, 14.4.7 and 14.10.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-95 CWE-94

Affected software

Vendor	Product	Versions
xwiki	xwiki-platform	>= 12.6.6, < 13.10.11; >= 14.0-rc-1, < 14.4.7; >= 14.5, < 14.10

References

https://github.com/xwiki/xwiki-platform/commit/df596f15368342236f8899ca122af8f3df0fe2e8Patch
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-vrr8-fp7c-7qgpExploit, Patch, Vendor Advisory
https://jira.xwiki.org/browse/XWIKI-20280Exploit, Issue Tracking, Patch, Vendor Advisory
https://github.com/xwiki/xwiki-platform/commit/df596f15368342236f8899ca122af8f3df0fe2e8Patch
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-vrr8-fp7c-7qgpExploit, Patch, Vendor Advisory
https://jira.xwiki.org/browse/XWIKI-20280Exploit, Issue Tracking, Patch, Vendor Advisory

Timeline

Published: Apr 16, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-305385.4Discourse is an open source platform for community discussion. Due to the improper sanitization of SVG files, an attacker can execute arbitr CVE-2023-305398.8Nextcloud is a personal home server system. Depending on the set up tags and other workflows this issue can be used to limit access of other CVE-2023-305404.3Nextcloud Talk is a chat, video & audio call extension for Nextcloud. In affected versions a user that was added later to a conversation can CVE-2023-305415.3OpenZeppelin Contracts is a library for secure smart contract development. A function in the implementation contract may be inaccessible if CVE-2023-305428.8OpenZeppelin Contracts is a library for secure smart contract development. The proposal creation entrypoint (`propose`) in `GovernorCompatib CVE-2023-305435.7@web3-react is a framework for building Ethereum Apps . In affected versions the `chainId` may be outdated if the user changes chains as par CVE-2023-305444.3Kiwi TCMS is an open source test management system. In versions of Kiwi TCMS prior to 12.2, users were able to update their email addresses CVE-2023-305456.5PrestaShop is an Open Source e-commerce web application. Prior to versions 8.0.4 and 1.7.8.9, it is possible for a user with access to the S CVE-2023-305467.5Contiki-NG is an operating system for Internet of Things devices. An off-by-one error can be triggered in the Antelope database management s CVE-2023-3054710.0vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. There exists a vulnerability in exception sanitizatio CVE-2023-305484.3gatsby-plugin-sharp is a plugin for the gatsby framework which exposes functions built on the Sharp image processing library. The gatsby-plu CVE-2023-305497.8Apptainer is an open source container platform for Linux. There is an ext4 use-after-free flaw that is exploitable through versions of Appta