Dashboard / CVE-2023-29525

CVE-2023-29525

HIGH
ACT NOW Priority: 6.84 BB Relevance: 78/100
Published: 2023-04-19 Modified: 2026-10-24 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
S: Unchanged
C: High
I: High
A: High

Description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Affected versions of xwiki are subject to code injection in the `since` parameter of the `/xwiki/bin/view/XWiki/Notifications/Code/LegacyNotificationAdministration` endpoint. This provides an XWiki syntax injection attack via the since-parameter, allowing privilege escalation from view to programming rights and subsequent code execution privilege. The vulnerability has been patched in XWiki 15.0-rc-1, 14.10.3, 14.4.8 and 14.10.3. Users are advised to upgrade. Users unable to upgrade may modify the page `XWiki.Notifications.Code.LegacyNotificationAdministration` to add the missing escaping. For versions < 14.6-rc-1 a workaround is to modify the file `<xwikiwebapp>/templates/distribution/eventmigration.wiki` to add the missing escaping.

Weakness Classification (1)

Affected Software (2)

VendorProductVersion
xwiki xwiki < 14.4.8
xwiki xwiki 14.5 – 14.10.3

References & Advisories (4)

https://jira.xwiki.org/browse/XWIKI-20287
Exploit Issue Tracking Patch

Bug Bounty Relevance

78 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction
✓ High exploitation probability

CVSS Score

8.8 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS — Exploitation Probability

77.75%
Raw Score 0.777520
Percentile 99.6%
Date 2026-10-28

Intelligence Sources

nvd ref →

External Links