{"id":"CVE-2023-29525","aliases":["EUVD-2023-1337","GHSA-jgg7-w2rj-58cj"],"status":"published","title":"Privilege escalation from view right on XWiki.Notifications.Code.LegacyNotificationAdministration in xwiki-platform","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Affected versions of xwiki are subject to code injection in the `since` parameter of the `/xwiki/bin/view/XWiki/Notifications/Code/LegacyNotificationAdministration` endpoint. This provides an XWiki syntax injection attack via the since-parameter, allowing privilege escalation from view to programming rights and subsequent code execution privilege. The vulnerability has been patched in XWiki 15.0-rc-1, 14.10.3, 14.4.8 and 14.10.3. Users are advised to upgrade. Users unable to upgrade may modify the page `XWiki.Notifications.Code.LegacyNotificationAdministration` to add the missing escaping. For versions \u003c 14.6-rc-1 a workaround is to modify the file `\u003cxwikiwebapp\u003e/templates/distribution/eventmigration.wiki` to add the missing escaping.","severity":{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.77752,"percentile":0.99572,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-74"],"published":"2023-04-18T23:01:46Z","modified":"2026-10-28T02:30:50Z","fixes":[{"ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-distribution-war","fixed_in":["13.10.11","14.4.8","14.6-rc-1"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-legacy-events-hibernate-ui","fixed_in":["14.10.3"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-distribution-war","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.6.1"},{"fixed":"13.10.11"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-distribution-war","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14.0-rc-1"},{"fixed":"14.4.8"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-distribution-war","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14.5"},{"fixed":"14.6-rc-1"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-legacy-events-hibernate-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14.6-rc-1"},{"fixed":"14.10.3"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-distribution-war","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.6.1"},{"fixed":"13.10.11"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-distribution-war","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14.0-rc-1"},{"fixed":"14.4.8"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-distribution-war","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14.5"},{"fixed":"14.6-rc-1"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-legacy-events-hibernate-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14.6-rc-1"},{"fixed":"14.10.3"}]}]}],"products":[{"vendor":"xwiki","product":"xwiki"},{"vendor":"xwiki","product":"xwiki-platform"}],"references":[{"url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-jgg7-w2rj-58cj","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Patch","Vendor Advisory","advisory","web"]},{"url":"https://github.com/xwiki/xwiki-platform/commit/6d74e2e4aa03d19f0be385ab63ae9e0f0e90a766","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://github.com/xwiki/xwiki-platform/commit/8e7c7f90f2ddaf067cb5b83b181af41513028754#diff-4e13f4ee4a42938bf1201b7ee71ca32edeacba22559daf0bcb89d534e0225949R70","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://jira.xwiki.org/browse/XWIKI-20287","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Patch","Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-29525","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-jgg7-w2rj-58cj"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/29xxx/CVE-2023-29525.json","tags":["advisory"]},{"url":"https://github.com/xwiki/xwiki-platform","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2023-29525","title":"Privilege escalation from view right on XWiki.Notifications.Code.LegacyNotificationAdministration in xwiki-platform","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Affected versions of xwiki are subject to code injection in the `since` parameter of the `/xwiki/bin/view/XWiki/Notifications/Code/LegacyNotificationAdministration` endpoint. This provides an XWiki syntax injection attack via the since-parameter, allowing privilege escalation from view to programming rights and subsequent code execution privilege. The vulnerability has been patched in XWiki 15.0-rc-1, 14.10.3, 14.4.8 and 14.10.3. Users are advised to upgrade. Users unable to upgrade may modify the page `XWiki.Notifications.Code.LegacyNotificationAdministration` to add the missing escaping. For versions \u003c 14.6-rc-1 a workaround is to modify the file `\u003cxwikiwebapp\u003e/templates/distribution/eventmigration.wiki` to add the missing escaping.","status":"published","published":"2023-04-18T23:01:46.239Z","modified":"2025-02-05T19:04:44.805Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:35:28.218693Z"}],"euvd":[{"id":"EUVD-2023-1337","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Affected versions of xwiki are subject to code injection in the `since` parameter of the `/xwiki/bin/view/XWiki/Notifications/Code/LegacyNotificationAdministration` endpoint. This provides an XWiki syntax injection attack via the since-parameter, allowing privilege escalation from view to programming rights and subsequent code execution privilege. The vulnerability has been patched in XWiki 15.0-rc-1, 14.10.3, 14.4.8 and 14.10.3. Users are advised to upgrade. Users unable to upgrade may modify the page `XWiki.Notifications.Code.LegacyNotificationAdministration` to add the missing escaping. For versions \u003c 14.6-rc-1 a workaround is to modify the file `\u003cxwikiwebapp\u003e/templates/distribution/eventmigration.wiki` to add the missing escaping.","status":"published","published":"2023-04-18T23:01:46Z","modified":"2025-02-05T19:04:44Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T00:04:04.235223Z"}],"ghsa":[{"id":"GHSA-jgg7-w2rj-58cj","title":"XWiki Platform vulnerable to privilege escalation from view right on XWiki.Notifications.Code.LegacyNotificationAdministration","description":"### Impact\n\nSteps to reproduce:\n\nOpen \u003cxwiki-host\u003e/xwiki/bin/view/XWiki/Notifications/Code/LegacyNotificationAdministration?since=%7B%7B%2Fhtml%7D%7D+%7B%7Basync+async%3D%22true%22+cached%3D%22false%22+context%3D%22doc.reference%22%7D%7D%7B%7Bgroovy%7D%7Dprintln%28%22Hello+%22+%2B+%22from+groovy%21%22%29%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fasync%7D%7D, where \u003cxwiki-host\u003e is the URL of your XWiki installation.\n\nThis demonstrates an XWiki syntax injection attack via the since-parameter, allowing privilege escalation from view to programming rights.\n\n### Patches\n\nThe vulnerability has been patched in XWiki 15.0-rc-1, 14.10.3, 14.4.8 and 14.10.3.\n\n### Workarounds\n\nFor versions \u003e= 14.6-rc-1 the workaround is to modify the page `XWiki.Notifications.Code.LegacyNotificationAdministration` to add the missing escaping, as described on https://github.com/xwiki/xwiki-platform/commit/8e7c7f90f2ddaf067cb5b83b181af41513028754#diff-4e13f4ee4a42938bf1201b7ee71ca32edeacba22559daf0bcb89d534e0225949R70\n\nFor versions \u003c 14.6-rc-1 the workaround is to modify the file `\u003cxwikiwebapp\u003e/templates/distribution/eventmigration.wiki` to add the missing escaping, as described on https://github.com/xwiki/xwiki-platform/commit/6d74e2e4aa03d19f0be385ab63ae9e0f0e90a766\n\n### References\n\nhttps://jira.xwiki.org/browse/XWIKI-20287\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)\n* Email us at [Security Mailing List](mailto:security@xwiki.org)","status":"published","published":"2023-04-20T22:25:42Z","modified":"2023-11-04T05:06:03Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:37:12.407027Z"}],"nvd":[{"id":"CVE-2023-29525","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Affected versions of xwiki are subject to code injection in the `since` parameter of the `/xwiki/bin/view/XWiki/Notifications/Code/LegacyNotificationAdministration` endpoint. This provides an XWiki syntax injection attack via the since-parameter, allowing privilege escalation from view to programming rights and subsequent code execution privilege. The vulnerability has been patched in XWiki 15.0-rc-1, 14.10.3, 14.4.8 and 14.10.3. Users are advised to upgrade. Users unable to upgrade may modify the page `XWiki.Notifications.Code.LegacyNotificationAdministration` to add the missing escaping. For versions \u003c 14.6-rc-1 a workaround is to modify the file `\u003cxwikiwebapp\u003e/templates/distribution/eventmigration.wiki` to add the missing escaping.","status":"published","published":"2023-04-19T00:15:09.127Z","modified":"2026-10-24T13:10:00.147Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:07:56.683259Z"}],"osv":[{"id":"CVE-2023-29525","title":"Privilege escalation from view right on XWiki.Notifications.Code.LegacyNotificationAdministration in xwiki-platform","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Affected versions of xwiki are subject to code injection in the `since` parameter of the `/xwiki/bin/view/XWiki/Notifications/Code/LegacyNotificationAdministration` endpoint. This provides an XWiki syntax injection attack via the since-parameter, allowing privilege escalation from view to programming rights and subsequent code execution privilege. The vulnerability has been patched in XWiki 15.0-rc-1, 14.10.3, 14.4.8 and 14.10.3. Users are advised to upgrade. Users unable to upgrade may modify the page `XWiki.Notifications.Code.LegacyNotificationAdministration` to add the missing escaping. For versions \u003c 14.6-rc-1 a workaround is to modify the file `\u003cxwikiwebapp\u003e/templates/distribution/eventmigration.wiki` to add the missing escaping.","status":"published","published":"2023-04-18T23:01:46.239Z","modified":"2026-10-28T02:30:50.373093837Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T15:44:31.468318Z"},{"id":"GHSA-jgg7-w2rj-58cj","title":"XWiki Platform vulnerable to privilege escalation from view right on XWiki.Notifications.Code.LegacyNotificationAdministration","description":"### Impact\n\nSteps to reproduce:\n\nOpen \u003cxwiki-host\u003e/xwiki/bin/view/XWiki/Notifications/Code/LegacyNotificationAdministration?since=%7B%7B%2Fhtml%7D%7D+%7B%7Basync+async%3D%22true%22+cached%3D%22false%22+context%3D%22doc.reference%22%7D%7D%7B%7Bgroovy%7D%7Dprintln%28%22Hello+%22+%2B+%22from+groovy%21%22%29%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fasync%7D%7D, where \u003cxwiki-host\u003e is the URL of your XWiki installation.\n\nThis demonstrates an XWiki syntax injection attack via the since-parameter, allowing privilege escalation from view to programming rights.\n\n### Patches\n\nThe vulnerability has been patched in XWiki 15.0-rc-1, 14.10.3, 14.4.8 and 14.10.3.\n\n### Workarounds\n\nFor versions \u003e= 14.6-rc-1 the workaround is to modify the page `XWiki.Notifications.Code.LegacyNotificationAdministration` to add the missing escaping, as described on https://github.com/xwiki/xwiki-platform/commit/8e7c7f90f2ddaf067cb5b83b181af41513028754#diff-4e13f4ee4a42938bf1201b7ee71ca32edeacba22559daf0bcb89d534e0225949R70\n\nFor versions \u003c 14.6-rc-1 the workaround is to modify the file `\u003cxwikiwebapp\u003e/templates/distribution/eventmigration.wiki` to add the missing escaping, as described on https://github.com/xwiki/xwiki-platform/commit/6d74e2e4aa03d19f0be385ab63ae9e0f0e90a766\n\n### References\n\nhttps://jira.xwiki.org/browse/XWIKI-20287\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)\n* Email us at [Security Mailing List](mailto:security@xwiki.org)","status":"published","published":"2023-04-20T22:25:42Z","modified":"2023-11-08T04:12:20.448222Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T15:46:50.336262Z"}]}}