CVE-2023-36469criticalCWE-74

CVE-2023-36469: fallo crítico en xwiki-platform

Code injection through NotificationRSSService in XWiki Platform

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear xwiki-platform+ Monitorear org.xwiki.platform:xwiki-platform-notifications-ui

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

50Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 10epss 82%
En resumen

Una falla en XWiki Platform permite que los usuarios ejecuten código malicioso a través de la configuración de notificaciones, otorgando al atacante control total sobre el contenido del wiki y el servidor.

Detalle técnico

La validación inadecuada de entrada en NotificationRSSService permite la inyección de código Groovy y Python arbitrarios cuando los usuarios modifican sus preferencias de perfil o notificación. Esta vulnerabilidad permite la ejecución remota de código con acceso irrestricto de lectura y escritura a todos los datos del wiki, sin requerir privilegios de administrador.

Resumen generado y traducido por IA a partir de la descripción oficial.
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user who can edit their own user profile and notification settings can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. This has been patched in XWiki 14.10.6 and 15.2RC1. Users are advised to update. As a workaround the main security fix can be manually applied by patching the affected document `XWiki.Notifications.Code.NotificationRSSService`. This will break the link to the differences, though as this requires additional changes to Velocity templates as shown in the patch. While the default template is available in the instance and can be easily patched, the template for mentions is contained in a `.jar`-file and thus cannot be fixed without replacing that jar.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Productos afectados
xwiki · xwiki-platform
CVEs relacionadas — xwiki-platform

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-24893CRITICALRemote code execution as guest via SolrSearchMacros request in xwikiEPSS 100.0%KEVCVE-2024-21650CRITICALXWiki Remote Code Execution vulnerability via user registrationEPSS 93.5%CVE-2023-37462CRITICALImproper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in org.xwiki.platform:xwiki-platform-skin-uiEPSS 91.6%CVE-2023-46731CRITICALRemote code execution through the section parameter in Administration as guest in XWiki PlatformEPSS 89.7%CVE-2025-32429CRITICALXWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameterEPSS 85.5%CVE-2023-50719HIGHXWiki Platform Solr search discloses password hashes of all usersEPSS 83.5%