CVE-2023-36469criticalCWE-74

CVE-2023-36469: critical vulnerability in xwiki-platform

Code injection through NotificationRSSService in XWiki Platform

Published · Updated

Follow this CVE+ Monitor xwiki-platform+ Monitor org.xwiki.platform:xwiki-platform-notifications-ui

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

50Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 10epss 82%
In short

A flaw in XWiki Platform allows users to execute malicious code through their notification settings, giving attackers complete control over wiki content and the server itself.

Technical detail

Improper input validation in NotificationRSSService permits code injection of arbitrary Groovy and Python script macros when users modify their profile or notification preferences. This vulnerability enables remote code execution with full read/write access to all wiki data without requiring administrator privileges.

Summary generated and translated by AI from the official description.
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user who can edit their own user profile and notification settings can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. This has been patched in XWiki 14.10.6 and 15.2RC1. Users are advised to update. As a workaround the main security fix can be manually applied by patching the affected document `XWiki.Notifications.Code.NotificationRSSService`. This will break the link to the differences, though as this requires additional changes to Velocity templates as shown in the patch. While the default template is available in the instance and can be easily patched, the template for mentions is contained in a `.jar`-file and thus cannot be fixed without replacing that jar.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected products
xwiki · xwiki-platform
Related CVEs — xwiki-platform

In the same product, most dangerous first.

CVE-2025-24893CRITICALRemote code execution as guest via SolrSearchMacros request in xwikiEPSS 100.0%KEVCVE-2024-21650CRITICALXWiki Remote Code Execution vulnerability via user registrationEPSS 93.5%CVE-2023-37462CRITICALImproper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in org.xwiki.platform:xwiki-platform-skin-uiEPSS 91.6%CVE-2023-46731CRITICALRemote code execution through the section parameter in Administration as guest in XWiki PlatformEPSS 89.7%CVE-2025-32429CRITICALXWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameterEPSS 85.5%CVE-2023-50719HIGHXWiki Platform Solr search discloses password hashes of all usersEPSS 83.5%