CVE-2023-29509: org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability
XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with view rights on commonly accessible documents can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of the documentTree macro parameters in This macro is installed by default in FlamingoThemesCode.WebHome. This page is installed by default. The vulnerability has been patched in XWiki 13.10.11, 14.4.7 and 14.10.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-29509?
CVE-2023-29509 is classified as a critical vulnerability due to the potential for arbitrary code execution.
How do I fix CVE-2023-29509?
To fix CVE-2023-29509, update your XWiki installation to version 14.4.0 or later, or to version 14.10-rc2 or higher.
Who is affected by CVE-2023-29509?
Any XWiki installation running versions prior to 14.4.0 or between 13.10 and 14.4.7 is affected by CVE-2023-29509.
What type of code can be executed due to CVE-2023-29509?
CVE-2023-29509 allows execution of arbitrary Groovy, Python, or Velocity code by users with view rights on accessible documents.
What can an attacker do with CVE-2023-29509?
An attacker leveraging CVE-2023-29509 can gain full access to the XWiki installation, potentially compromising the entire platform.