CVE-2023-35150criticalCWE-95

CVE-2023-35150: critical vulnerability in xwiki-platform

XWiki Platform vulnerable to privilege escalation (PR) from view right via Invitation application

Published · Updated

50Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.9epss 78%
exploitation probability
78%top 1% of all CVEs
observed exploitation
nono source reports it
In short

A flaw in XWiki's Invitation application allows any user with basic viewing permission to execute code with administrator-level privileges by crafting a malicious URL, potentially taking over the entire system.

Technical detail

CWE-95 (Improper Neutralization of Directives in Dynamically Evaluated Code) in XWiki's Invitation application permits privilege escalation from view rights to programming rights. An authenticated attacker can craft a specially-formed URL to inject and execute arbitrary code in the context of elevated privileges, achieving remote code execution. Affected versions: 2.40m-2 through 14.4.7, 14.10.3, and versions before 15.0.

Summary generated and translated by AI from the official description.
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 2.40m-2 and prior to versions 14.4.8, 14.10.4, and 15.0, any user with view rights on any document can execute code with programming rights, leading to remote code execution by crafting an url with a dangerous payload. The problem has been patched in XWiki 15.0, 14.10.4 and 14.4.8.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
Affected products
xwiki · xwiki-platform
Related CVEs — xwiki-platform

In the same product, most dangerous first.

CVE-2025-24893CRITICALRemote code execution as guest via SolrSearchMacros request in xwikiEPSS 99.9%KEVCVE-2024-21650CRITICALXWiki Remote Code Execution vulnerability via user registrationEPSS 93.5%CVE-2023-37462CRITICALImproper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in org.xwiki.platform:xwiki-platform-skin-uiEPSS 91.6%CVE-2023-46731CRITICALRemote code execution through the section parameter in Administration as guest in XWiki PlatformEPSS 88.5%CVE-2025-32429CRITICALXWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameterEPSS 87.1%CVE-2023-50719HIGHXWiki Platform Solr search discloses password hashes of all usersEPSS 83.5%
References
https://github.com/xwiki/xwiki-platform/commit/b65220a4d86b8888791c3b643074ebca5c089a3ahttps://github.com/xwiki/xwiki-platform/security/advisories/GHSA-6mf5-36v9-3h2whttps://jira.xwiki.org/browse/XWIKI-20285