CVE-2023-36469

Summary

CVE-2023-36469 is a vulnerability found in XWiki Platform, a generic wiki platform that provides runtime services for applications built on top of it. The vulnerability allows any user who can edit their own user profile and notification settings to execute arbitrary script macros, including Groovy and Python macros, which can lead to remote code execution. This can result in unrestricted read and write access to all wiki contents. The issue has been patched in XWiki versions 14.10.6 and 15.2RC1, so users are advised to update their software. As a temporary workaround, the main security fix can be manually applied by patching the affected document "XWiki.Notifications.Code.NotificationRSSService." However, this workaround breaks the link to the differences and requires additional changes to Velocity templates. The vulnerability poses a potential danger to organizations as it allows unauthorized individuals to execute malicious code and gain unauthorized access to sensitive information stored in the wiki platform.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.