CVE-2023-50721
CVSS 3.1 Score 9.9 of 10 (high)
Details
Summary
CVE-2023-50721 is a vulnerability that affects XWiki Platform versions 4.5-rc-1 to 14.10.15, 15.5.2, and 15.7-rc-1. It allows for the injection of XWiki syntax containing script macros, including Groovy macros, that can lead to remote code execution and impact the confidentiality, integrity, and availability of the entire XWiki instance. Any user with the ability to edit wiki pages can execute this attack by adding user interface extensions to any document. The necessary patch has been released in versions 14.10.15, 15.5.2, and 15.7RC1, but as a workaround, the patch can be manually applied to the page "XWiki.SearchAdmin". This vulnerability poses a high danger to organizations using vulnerable versions of XWiki Platform as it allows for remote code execution with low privileges required and no user interaction needed.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions