Miggo Logo
Book a Demo
Miggo Vulnerability Database
→
CVE-2023-29525

CVE-2023-29525:
XWiki Platform vulnerable to privilege escalation from view right on XWiki.Notifications.Code.LegacyNotificationAdministration

10

CVSS Score

Basic Information

CVE ID
CVE-2023-29525
GHSA ID
GHSA-jgg7-w2rj-58cj
EPSS Score
-
CWE
CWE-74
Published
4/20/2023
Updated
11/4/2023
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
org.xwiki.platform:xwiki-platform-distribution-warmaven>= 12.6.1, < 13.10.1113.10.11
org.xwiki.platform:xwiki-platform-distribution-warmaven>= 14.0-rc-1, < 14.4.814.4.8
org.xwiki.platform:xwiki-platform-distribution-warmaven>= 14.5, < 14.6-rc-114.6-rc-1
org.xwiki.platform:xwiki-platform-legacy-events-hibernate-uimaven>= 14.6-rc-1, < 14.10.314.10.3

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from improper output encoding in the LegacyNotificationAdministration template. The unescaped $!request.since parameter in the date input field allows attackers to inject XWiki syntax. The patch adds $escapetool.xml() to sanitize the input, confirming this was the vulnerable point. The template's role in rendering user-controlled data without proper escaping directly enables the injection vector described in the advisory.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t St*ps to r*pro*u**: Op*n <xwiki-*ost>/xwiki/*in/vi*w/XWiki/Noti*i**tions/*o**/L****yNoti*i**tion**ministr*tion?sin**=%**%**%***tml%**%**+%**%***syn*+*syn*%**%**tru*%**+******%**%****ls*%**+*ont*xt%**%***o*.r***r*n**%**%**%**%**%***roovy%

Reasoning

T** vuln*r**ility st*ms *rom improp*r output *n*o*in* in t** L****yNoti*i**tion**ministr*tion t*mpl*t*. T** un*s**p** `$!r*qu*st.sin**` p*r*m*t*r in t** **t* input *i*l* *llows *tt**k*rs to inj**t XWiki synt*x. T** p*t** ***s `$*s**p*tool.xml()` to s