CVE-2023-36469

CVSS Score of 10 (low)

Details

Published Jun 29, 2023
Updated: Jul 10, 2023
CWE ID 74

Summary

CVE-2023-36469 is a vulnerability found in XWiki Platform, a generic wiki platform that provides runtime services for applications built on top of it. The vulnerability allows any user who can edit their own user profile and notification settings to execute arbitrary script macros, including Groovy and Python macros, which can lead to remote code execution. This can result in unrestricted read and write access to all wiki contents. The issue has been patched in XWiki versions 14.10.6 and 15.2RC1, so users are advised to update their software. As a temporary workaround, the main security fix can be manually applied by patching the affected document "XWiki.Notifications.Code.NotificationRSSService." However, this workaround breaks the link to the differences and requires additional changes to Velocity templates. The vulnerability poses a potential danger to organizations as it allows unauthorized individuals to execute malicious code and gain unauthorized access to sensitive information stored in the wiki platform.

Leverage our Vulnerability Intelligence module to secure your systems now - get detailed insights on CVE-2024-37364. Book your demo today.

Share

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2023-36469 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options