{"id":"CVE-2023-29519","published":"2023-04-18T23:31:09Z","modified":"2025-02-05T18:46:04Z","title":"Code injection in org.xwiki.platform:xwiki-platform-attachment-ui","vendor":"xwiki","product":"xwiki-platform","tier":"tail","description":{"text":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A registered user can perform remote code execution leading to privilege escalation by injecting the proper code in the \"property\" field of an attachment selector, as a gadget of their own dashboard.  Note that the vulnerability does not impact comments of a wiki. The vulnerability has been patched in XWiki 13.10.11, 14.4.8, 14.10.2, 15.0-rc-1. Users are advised to upgrade. There are no known workarounds for this vulnerability.","provenance":"source","from":"CVE.org"},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.01945,"percentile":0.80176,"provenance":"source"},"cwes":[{"id":"CWE-74","name":"Improper Neutralization of Special Elements in Output Used by a Downstream Component"}],"references":[{"url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-3hjg-cghv-22ww","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/xwiki/xwiki-platform/commit/5e8725b4272cd3e5be09d3ca84273be2da6869c1","tags":["x_refsource_MISC"]},{"url":"https://jira.xwiki.org/browse/XWIKI-20364","tags":["x_refsource_MISC"]}],"priority":{"score":22.4,"factors":[{"name":"EPSS percentile","points":16.04},{"name":"CVSS severity","points":6.37}]},"vendorSlug":"xwiki","affectedVersions":[{"vendor":"xwiki","product":"xwiki-platform","versions":["< 13.10.11",">= 14.0.0, < 14.4.8",">= 14.5.0, < 14.10.2"]}],"affected":[{"ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-attachment-ui","vulnerableRanges":[">=3.0-rc-1, <13.10.11",">=14.0-rc-1, <14.4.8",">=14.5, <14.10.2"],"patched":["13.10.11","14.4.8","14.10.2"],"from":["GHSA-3hjg-cghv-22ww"],"provenance":"source"}],"euvd":{"id":"EUVD-2023-1174","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2022-36097","published":"2022-09-08","fixed":"14.4-rc-1","kev":false},{"cve":"CVE-2022-41928","published":"2022-11-23","fixed":"14.4.2","kev":false,"link":{"from":"CVE-2022-41928","to":"CVE-2023-29519","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.xwiki.platform:xwiki-platform-attachment-ui","fromFixed":"13.10.7","toFixed":"13.10.11","daysApart":146},{"kind":"version-step","provenance":"source","package":"Maven:org.xwiki.platform:xwiki-platform-attachment-ui","fromFixed":"14.4.2","toFixed":"14.4.8","daysApart":146}]}},{"cve":"CVE-2023-29516","published":"2023-04-18","fixed":"14.10.1","kev":false,"link":{"from":"CVE-2023-29516","to":"CVE-2023-29519","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.xwiki.platform:xwiki-platform-attachment-ui","fromFixed":"14.10.1","toFixed":"14.10.2","daysApart":0}]}},{"cve":"CVE-2023-29519","published":"2023-04-18","fixed":"14.10.2","kev":false}],"package":"Maven:org.xwiki.platform:xwiki-platform-attachment-ui"}}