Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CVE-2023-37909— Privilege escalation (PR)/remote code execution from account through Menu.UIExtensionSheet

CVSS 10.0 · Critical EPSS 10.46% · P93
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2023-37909

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Privilege escalation (PR)/remote code execution from account through Menu.UIExtensionSheet
Source: NVD (National Vulnerability Database)
Vulnerability Description
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 5.1-rc-1 and prior to versions 14.10.8 and 15.3-rc-1, any user who can edit their own user profile can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. This has been patched in XWiki 14.10.8 and 15.3-rc-1 by adding proper escaping. As a workaround, the patch can be manually applied to the document `Menu.UIExtensionSheet`; only three lines need to be changed.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
动态执行代码中指令转义处理不恰当(Eval注入)
Source: NVD (National Vulnerability Database)
Vulnerability Title
XWiki Platform 代码注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
XWiki Platform是法国XWiki基金会的一套用于创建Web协作应用程序的Wiki平台。 XWiki Platform 存在安全漏洞，该漏洞源于任何可以编辑自己的用户配置文件的用户都可以执行任意脚本宏，包括可以造成远程代码执行的 Groovy 和 Python 宏。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
xwikixwiki-platform >= 5.1-rc-1, < 14.10.8 -

II. Public POCs for CVE-2023-37909

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2023-37909

请登录查看更多情报信息。

Same Patch Batch · xwiki · 2023-10-25 · 10 CVEs total

CVE-2023-3791310.0 CRITICALorg.xwiki.platform:xwiki-platform-office-importer vulnerable to arbitrary server side file
CVE-2023-3791210.0 CRITICALXWiki Rendering's footnote macro vulnerable to privilege escalation via the footnote macro
CVE-2023-451369.7 CRITICALXWiki Platform web templates vulnerable to reflected XSS in the create document form if na
CVE-2023-451379.1 CRITICALXWiki Platform XSS with edit right in the create document form for existing pages
CVE-2023-451359.1 CRITICALXWiki users can be tricked to execute scripts as the create page action doesn't display th
CVE-2023-451349.1 CRITICALXWiki Platform XSS vulnerability from account in the create page form via template provide
CVE-2023-379089.1 CRITICALorg.xwiki.rendering:xwiki-rendering-xml Improper Neutralization of Invalid Characters in I
CVE-2023-379108.1 HIGHorg.xwiki.platform:xwiki-platform-attachment-api vulnerable to Missing Authorization on At
CVE-2023-379116.5 MEDIUMorg.xwiki.platform:xwiki-platform-oldcore may leak data through deleted and re-created doc

IV. Related Vulnerabilities

Same product: xwiki-platform
Same vendor: xwiki
Same weakness: CWE-95

V. Comments for CVE-2023-37909

No comments yet

Leave a comment