cve/2023/CVE-2023-29519.md

### [CVE-2023-29519](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29519)
![](https://img.shields.io/static/v1?label=Product&message=xwiki-platform&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3D%20%3C%2013.10.11%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-74%3A%20Improper%20Neutralization%20of%20Special%20Elements%20in%20Output%20Used%20by%20a%20Downstream%20Component%20('Injection')&color=brighgreen)

### Description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A registered user can perform remote code execution leading to privilege escalation by injecting the proper code in the "property" field of an attachment selector, as a gadget of their own dashboard.  Note that the vulnerability does not impact comments of a wiki. The vulnerability has been patched in XWiki 13.10.11, 14.4.8, 14.10.2, 15.0-rc-1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

### POC

#### Reference
- https://jira.xwiki.org/browse/XWIKI-20364
- https://jira.xwiki.org/browse/XWIKI-20364

#### Github
No PoCs found on GitHub currently.
Update Sat May 25 21:48:12 CEST 2024 2024-05-25 21:48:12 +02:00			`### [CVE-2023-29519](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29519)`
			`![](https://img.shields.io/static/v1?label=Product&message=xwiki-platform&color=blue)`
			`![](https://img.shields.io/static/v1?label=Version&message=%3D%20%3C%2013.10.11%20&color=brighgreen)`
			`![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-74%3A%20Improper%20Neutralization%20of%20Special%20Elements%20in%20Output%20Used%20by%20a%20Downstream%20Component%20('Injection')&color=brighgreen)`

			`### Description`

			XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A registered user can perform remote code execution leading to privilege escalation by injecting the proper code in the "property" field of an attachment selector, as a gadget of their own dashboard. Note that the vulnerability does not impact comments of a wiki. The vulnerability has been patched in XWiki 13.10.11, 14.4.8, 14.10.2, 15.0-rc-1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

			`### POC`

			`#### Reference`
			`- https://jira.xwiki.org/browse/XWIKI-20364`
Update CVE sources 2024-06-09 00:33 2024-06-09 00:33:16 +00:00			`- https://jira.xwiki.org/browse/XWIKI-20364`
Update Sat May 25 21:48:12 CEST 2024 2024-05-25 21:48:12 +02:00
			`#### Github`
			`No PoCs found on GitHub currently.`