Eval Injection in XWiki platform - CVE-2023-37909
Published: October 25, 2023 / Updated: May 5, 2026
Vulnerability identifier: #VU129925
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-37909
CWE-ID: CWE-95
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to improper neutralization of directives in dynamically evaluated code in Menu.UIExtensionSheet when processing user-controlled UIExtensionClass data from a user profile. A remote user can add a crafted UIExtensionClass object to their own profile and access the sheet to execute arbitrary code.
The issue can be exploited by a user who is able to edit their own user profile, and it also allows unrestricted read and write access to all wiki contents.
Affected software
XWiki platform
How to mitigate CVE-2023-37909
Install security update from vendor's website.
XWiki platform - addressed in versions 14.10.8, 15.3