Eval Injection in XWiki platform - CVE-2023-29521

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU129962

Eval Injection in XWiki platform - CVE-2023-29521

Published: April 18, 2023 / Updated: May 5, 2026


Vulnerability identifier: #VU129962
CSH Severity: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2023-29521
CWE-ID: CWE-95
Exploitation vector: Remote access
Exploit availability: No public exploit available
Vulnerable software:
XWiki platform
Software vendor:
XWiki

Description

The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to improper neutralization of directives in dynamically evaluated code in Macro.VFSTreeMacro when rendering the VFS Tree macro. A remote user can execute arbitrary Groovy, Python or Velocity code to execute arbitrary code.

The vulnerable page is not installed by default.


Remediation

Install security update from vendor's website.

External links