CVE-2023-37462criticalobserved exploitationCWE-74CWE-95

CVE-2023-37462: critical vulnerability in xwiki-platform

Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in org.xwiki.platform:xwiki-platform-skin-ui

Published · Updated

Follow this CVE+ Monitor xwiki-platform+ Monitor org.xwiki.platform:xwiki-platform-skin-ui

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

87Vexday Risk Score

Patch now. It exploitation observed by VulnCheck and has a working public exploit.

ssvc Actcvss 10epss 92%
from disclosure to weapon
Published on NVDJul 14
VulnCheck+1152d
In short

A flaw in XWiki's skin system allows attackers to inject and execute arbitrary code by crafting a malicious page name. Anyone with basic viewing access can exploit this to gain full control over the wiki, including reading and modifying all content.

Technical detail

Improper neutralization of code directives in the SkinsCode.XWikiSkinsSheet document permits eval injection via unsanitized page names. An unauthenticated or low-privileged user can escalate to programming rights by triggering dynamic code evaluation of malicious Groovy or Python macros, achieving remote code execution with complete wiki access.

Summary generated and translated by AI from the official description.
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Improper escaping in the document `SkinsCode.XWikiSkinsSheet` leads to an injection vector from view right on that document to programming rights, or in other words, it is possible to execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. The attack works by opening a non-existing page with a name crafted to contain a dangerous payload. It is possible to check if an existing installation is vulnerable. See the linked GHSA for instructions on testing an installation. This issue has been patched in XWiki 14.4.8, 14.10.4 and 15.0-rc-1. Users are advised to upgrade. The fix commit `d9c88ddc` can also be applied manually to the impacted document `SkinsCode.XWikiSkinsSheet` and users unable to upgrade are advised to manually patch their installations.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected products
xwiki · xwiki-platform
Related CVEs — xwiki-platform

In the same product, most dangerous first.

CVE-2025-24893CRITICALRemote code execution as guest via SolrSearchMacros request in xwikiEPSS 100.0%KEVCVE-2024-21650CRITICALXWiki Remote Code Execution vulnerability via user registrationEPSS 93.5%CVE-2023-46731CRITICALRemote code execution through the section parameter in Administration as guest in XWiki PlatformEPSS 89.7%CVE-2025-32429CRITICALXWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameterEPSS 85.5%CVE-2023-50719HIGHXWiki Platform Solr search discloses password hashes of all usersEPSS 83.5%CVE-2024-31984CRITICALXWiki Platform: Remote code execution through space title and Solr space facetEPSS 83.0%