xwiki · xwiki-platform
The XWiki Platform (xwiki-platform) contains a code injection flaw in the XWiki.SchedulerJobSheet component, where the Job Script field of the XWiki.SchedulerJobClass object can be used to inject Groovy code. An attacker who holds a low-privilege account, requires no user interaction, and needs only network access to the wiki can add such an object to their own user profile, and the injected Groovy code then runs in the server context when the sheet is viewed.
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to execute anything with the right of the Scheduler Application sheet page. A user without script or programming rights, edit your user profile with the object editor and add a new object of type XWiki.SchedulerJobClass, In "Job Script", groovy code can be added and will be executed in the server context on viewing. This has been patched in XWiki 14.10.3 and 15.0 RC1. Users are advised to upgrade. There are no known workarounds for this issue.
Disclosed on 18 Apr 2023. No public exploit code or confirmed exploitation is recorded.
4 fixes in xwiki-platform-scheduler-ui over 20 months. The latest fix listed for xwiki-platform-scheduler-ui is 16.3.0.
No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
1 package in 1 ecosystem. Main package: org.xwiki.platform:xwiki-platform-scheduler-ui.
Upgrade to 14.10.3 or later
Set the version to 14.10.3 or later in your pom.xml or build.gradle.
The first fix for CVE-2023-29524. No other CVE tracked by Patchfirst affects this package.
| If you run | Upgrade to |
|---|---|
| 2.0.1 up to 14.10.3 | 14.10.3 |
“Up to” means the second version is the fix and is not affected.