{"id":"CVE-2023-29211","aliases":["EUVD-2023-1406","GHSA-w7v9-fc49-4qg4"],"status":"published","title":"org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki Eval Injection vulnerability","description":"XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with view rights `WikiManager.DeleteWiki` can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of the `wikiId` url parameter. The problem has been patched on XWiki  13.10.11, 14.4.7, and 14.10.","severity":{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.01193,"percentile":0.68279,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-94","CWE-95"],"published":"2023-04-12T20:35:30Z","modified":"2026-10-28T02:30:52Z","fixes":[{"ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki","fixed_in":["13.10.11","14.4.7","14.10"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3-milestone-2"},{"fixed":"13.10.11"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14.0-rc-1"},{"fixed":"14.4.7"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14.5"},{"fixed":"14.10"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3-milestone-2"},{"fixed":"13.10.11"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14.0-rc-1"},{"fixed":"14.4.7"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14.5"},{"fixed":"14.10"}]}]}],"products":[{"vendor":"xwiki","product":"xwiki"},{"vendor":"xwiki","product":"xwiki-platform"}],"references":[{"url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-w7v9-fc49-4qg4","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Patch","Vendor Advisory","advisory","web"]},{"url":"https://github.com/xwiki/xwiki-platform/commit/ba4c76265b0b8a5e2218be400d18f08393fe1428#diff-64f39f5f2cc8c6560a44e21a5cfd509ef00e8a2157cd9847c9940a2e08ea43d1R63-R64","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://jira.xwiki.org/browse/XWIKI-20297","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-29211","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-w7v9-fc49-4qg4"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/29xxx/CVE-2023-29211.json","tags":["advisory"]},{"url":"https://github.com/xwiki/xwiki-platform","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2023-29211","title":"org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki Eval Injection vulnerability","description":"XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with view rights `WikiManager.DeleteWiki` can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of the `wikiId` url parameter. The problem has been patched on XWiki  13.10.11, 14.4.7, and 14.10.","status":"published","published":"2023-04-16T06:34:27.926Z","modified":"2025-02-06T17:05:23.638Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-95"],"updated_at":"2026-11-02T14:35:28.643185Z"}],"euvd":[{"id":"EUVD-2023-1406","description":"XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with view rights `WikiManager.DeleteWiki` can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of the `wikiId` url parameter. The problem has been patched on XWiki  13.10.11, 14.4.7, and 14.10.","status":"published","published":"2023-04-16T06:34:27Z","modified":"2025-02-06T17:05:23Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T00:04:02.906364Z"}],"ghsa":[{"id":"GHSA-w7v9-fc49-4qg4","title":"org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki Eval Injection vulnerability","description":"### Impact\nAny user with view rights `WikiManager.DeleteWiki` can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of the `wikiId` url parameter.\n\nA proof of concept exploit is to open \u003cxwiki-host\u003e/xwiki/bin/view/WikiManager/DeleteWiki?wikiId=%22+%2F%7D%7D+%7B%7Basync+async%3D%22true%22+cached%3D%22false%22+context%3D%22doc.reference%22%7D%7D%7B%7Bgroovy%7D%7Dprintln%28%22Hello+from+groovy%21%22%29%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fasync%7D%7D where \u003cxwiki-host\u003e is the URL of your XWiki installation.\n\n### Patches\nThe problem has been patched on XWiki  13.10.11, 14.4.7, and 14.10.\n\n### Workarounds\nThe issue can be fixed manually applying this [patch](https://github.com/xwiki/xwiki-platform/commit/ba4c76265b0b8a5e2218be400d18f08393fe1428#diff-64f39f5f2cc8c6560a44e21a5cfd509ef00e8a2157cd9847c9940a2e08ea43d1R63-R64).\n\nIf you have any questions or comments about this advisory:\n* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)\n* Email us at [Security Mailing List](mailto:security@xwiki.org)\n","status":"published","published":"2023-04-12T20:35:30Z","modified":"2023-04-26T20:33:27Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94","CWE-95"],"updated_at":"2026-11-02T14:36:51.39133Z"}],"nvd":[{"id":"CVE-2023-29211","description":"XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with view rights `WikiManager.DeleteWiki` can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of the `wikiId` url parameter. The problem has been patched on XWiki  13.10.11, 14.4.7, and 14.10.","status":"published","published":"2023-04-16T07:15:52.873Z","modified":"2026-06-17T05:49:37.3Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-95","CWE-94"],"updated_at":"2026-11-02T14:07:55.652109Z"}],"osv":[{"id":"CVE-2023-29211","title":"org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki Eval Injection vulnerability","description":"XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with view rights `WikiManager.DeleteWiki` can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of the `wikiId` url parameter. The problem has been patched on XWiki  13.10.11, 14.4.7, and 14.10.","status":"published","published":"2023-04-16T06:34:27.926Z","modified":"2026-10-28T02:30:52.463602568Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-95"],"updated_at":"2026-11-02T15:44:31.468318Z"},{"id":"GHSA-w7v9-fc49-4qg4","title":"org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki Eval Injection vulnerability","description":"### Impact\nAny user with view rights `WikiManager.DeleteWiki` can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of the `wikiId` url parameter.\n\nA proof of concept exploit is to open \u003cxwiki-host\u003e/xwiki/bin/view/WikiManager/DeleteWiki?wikiId=%22+%2F%7D%7D+%7B%7Basync+async%3D%22true%22+cached%3D%22false%22+context%3D%22doc.reference%22%7D%7D%7B%7Bgroovy%7D%7Dprintln%28%22Hello+from+groovy%21%22%29%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fasync%7D%7D where \u003cxwiki-host\u003e is the URL of your XWiki installation.\n\n### Patches\nThe problem has been patched on XWiki  13.10.11, 14.4.7, and 14.10.\n\n### Workarounds\nThe issue can be fixed manually applying this [patch](https://github.com/xwiki/xwiki-platform/commit/ba4c76265b0b8a5e2218be400d18f08393fe1428#diff-64f39f5f2cc8c6560a44e21a5cfd509ef00e8a2157cd9847c9940a2e08ea43d1R63-R64).\n\nIf you have any questions or comments about this advisory:\n* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)\n* Email us at [Security Mailing List](mailto:security@xwiki.org)\n","status":"published","published":"2023-04-12T20:35:30Z","modified":"2026-09-10T03:50:01.199932022Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94","CWE-95"],"updated_at":"2026-11-02T15:46:58.401149Z"}]}}