Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
Web Application Vulnerabilities Runtime SCA Findings
Looking for the vulnerability index of Invicti's legacy products?
Invicti Enterprise Acunetix Standard & Premium
XWiki Platform RCE (CVE-2023-37462) - Vulnerability Database

XWiki Platform RCE (CVE-2023-37462)

Description

XWiki Platform suffers from an injection flaw in the SkinsCode.XWikiSkinsSheet, allowing attackers with view access to execute arbitrary code including Groovy and Python macros.

Remediation

Upgrade to XWiki versions 14.4.8, 14.10.4, 15.0-rc-1 pr higher to resolve this vulnerability.

References

XWiki Security Advisory

Related Vulnerabilities

CakePHP 1.3.5 / 1.2.8 unserialize() vulnerability High
Common tags: Known Vulnerabilities
Python Improper Neutralization of CRLF Sequences ('CRLF Injection') Vulnerability (CVE-2019-9740) Medium
Common tags: Known Vulnerabilities
PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2019-9640) High
Common tags: Known Vulnerabilities
PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2019-9641) Critical
Common tags: Known Vulnerabilities
Python Uncontrolled Resource Consumption Vulnerability (CVE-2019-9674) High
Common tags: Known Vulnerabilities

Severity

High

Classification

CVE-2023-37462
CWE-74
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Remote Code Execution
Known Vulnerabilities