Eval Injection in XWiki platform - CVE-2023-29210
Published: April 12, 2023 / Updated: May 5, 2026
Vulnerability identifier: #VU129987
CSH Severity: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2023-29210
CWE-ID: CWE-95
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
XWiki platform
XWiki platform
Software vendor:
XWiki
XWiki
Description
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to improper neutralization of directives in dynamically evaluated code in the notification preferences macros when processing the user parameter. A remote user can inject crafted macro input to execute arbitrary code.
The affected macros are used in user profiles and are installed by default in XWiki.
Remediation
Install security update from vendor's website.