CVE-2023-50732

MediumCVSS 6.3/10Last modified Jun 17, 2026

Description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to execute a Velocity script without script right through the document tree. This has been patched in XWiki 14.10.7 and 15.2RC1.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
xwiki	xwiki-platform	>= 8.3-rc-1, < 14.10.7; >= 15.0-rc-1, < 15.2-rc-1

References

https://github.com/xwiki/xwiki-platform/commit/41d7dca2d30084966ca6a7ee537f39ee8354a7e3Patch
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-p5f8-qf24-24cjExploit, Mitigation, Patch, Vendor Advisory
https://jira.xwiki.org/browse/XWIKI-20625Exploit, Issue Tracking, Vendor Advisory
https://github.com/xwiki/xwiki-platform/commit/41d7dca2d30084966ca6a7ee537f39ee8354a7e3Patch
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-p5f8-qf24-24cjExploit, Mitigation, Patch, Vendor Advisory
https://jira.xwiki.org/browse/XWIKI-20625Exploit, Issue Tracking, Vendor Advisory

Timeline

Published: Dec 21, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-507338.6A Server-Side Request Forgery (SSRF) vulnerability has been identified in the Web Services feature of newer Lexmark devices.CVE-2023-507349.0A buffer overflow vulnerability has been identified in PostScript interpreter in various Lexmark devices. The vulnerability can be leveraged CVE-2023-507359.0A heap corruption vulnerability has been identified in PostScript interpreter in various Lexmark devices. The vulnerability can be leveraged CVE-2023-507369.0A memory corruption vulnerability has been identified in PostScript interpreter in various Lexmark devices. The vulnerability can be leverag CVE-2023-507379.1The SE menu contains information used by Lexmark to diagnose device errors. A vulnerability in one of the SE menu routines can be leveraged CVE-2023-507384.3A new feature to prevent Firmware downgrades was recently added to some Lexmark products. A method to override this downgrade protection ha CVE-2023-507398.8A buffer overflow vulnerability has been identified in the Internet Printing Protocol (IPP) in various Lexmark devices. The vulnerability ca CVE-2023-50749.8Use of a static key to protect a JWT token used in user authentication can allow an for an authentication bypass in D-Link D-View 8 v2.0.1.2 CVE-2023-507405.3In Apache Linkis <=1.4.0, The password is printed to the log when using the Oracle data source of the Linkis data source module. We recomme CVE-2023-507439.8Online Notice Board System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'dd' parameter of the registrat CVE-2023-50756.7A buffer overflow was reported in the FmpSipoCapsuleDriver driver in the IdeaPad Duet 3-10IGL5 that may allow a local attacker with elevated CVE-2023-507529.8Online Notice Board System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'e' parameter of the login.php