Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
XWiki Improper Control of Generation of Code (Code Injection) Vulnerability - CVE-2023-35152 - Vulnerability Database
XWikiplatform

XWiki Improper Control of Generation of Code (Code Injection) Vulnerability - CVE-2023-35152

High
Reference: CVE-2023-35152
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2023-35152
Title: XWiki Improper Control of Generation of Code (Code Injection) Vulnerability
Overview:

XWiki Platform is a generic wiki platform. Starting in version 12.9-rc-1 and prior to versions 14.4.8 14.10.6 and 15.1 any logged in user can add dangerous content in their first name field and see it executed with programming rights. Leading to rights escalation. The vulnerability has been fixed on XWiki 14.4.8 14.10.6 and 15.1. As a workaround one may apply the patch manually.