Privilege Escalation Affecting org.xwiki.platform:xwiki-platform-core package, versions [7.0-rc-1,14.4.8) [14.5,14.10.4)
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGXWIKIPLATFORM-5777692
- published 16 Jul 2023
- disclosed 16 Jul 2023
- credit Unknown
Introduced: 16 Jul 2023
CVE-2023-37462 Open this link in a new tabHow to fix?
Upgrade org.xwiki.platform:xwiki-platform-core to version 14.4.8, 14.10.4 or higher.
Overview
Affected versions of this package are vulnerable to Privilege Escalation due to improper escaping in the document SkinsCode.XWikiSkinsSheet, allowing the attacker to escalate privileges from view rights on that document to programming rights. This vulnerability allows the execution of arbitrary script macros, including Groovy and Python macros that allow remote code execution, including unrestricted read and write access to all wiki contents.
Exploiting this vulnerability is possible by opening a non-existing page with a name crafted to contain a dangerous payload.