VYPR
← All advisories
High severityNVD Advisory· Published Apr 18, 2023· Updated Feb 5, 2025

Code injection in org.xwiki.platform:xwiki-platform-attachment-ui

CVE-2023-29519

Description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A registered user can perform remote code execution leading to privilege escalation by injecting the proper code in the "property" field of an attachment selector, as a gadget of their own dashboard. Note that the vulnerability does not impact comments of a wiki. The vulnerability has been patched in XWiki 13.10.11, 14.4.8, 14.10.2, 15.0-rc-1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.xwiki.platform:xwiki-platform-attachment-uiMaven
>= 3.0-rc-1, < 13.10.1113.10.11
org.xwiki.platform:xwiki-platform-attachment-uiMaven
>= 14.0-rc-1, < 14.4.814.4.8
org.xwiki.platform:xwiki-platform-attachment-uiMaven
>= 14.5, < 14.10.214.10.2

Affected products

1

Patches

1
5e8725b4272c

XWIKI-20354: Attachment selector properties are missing escaping

https://github.com/xwiki/xwiki-platformSimon UrliDec 7, 2022via ghsa
commit
1 file changed · +1 −1
  • xwiki-platform-core/xwiki-platform-attachment/xwiki-platform-attachment-ui/src/main/resources/XWiki/AttachmentSelector.xml+1 −1 modified
    @@ -1651,7 +1651,7 @@ $xwiki.ssx.use($xcontext.macro.doc.fullName)##
 #elseif ($xcontext.action == 'inline' || $xcontext.action == 'edit')
   (% class="attachment-picker" %)(((##
     #attachmentPicker_displayAttachment($propValue $displayImage false true) #attachmentPicker_displayButton()##
-    {{html}}&lt;input type="hidden" name="${classname}_${object}_${property}" value="${propValue}" class="property-reference"/&gt;{{/html}}##
+    {{html}}&lt;input type="hidden" name="$escapetool.xml("${classname}_${object}_${property}")" value="$escapetool.xml("${propValue}")" class="property-reference"/&gt;{{/html}}##
   )))
 #else
   #attachmentPicker_displayAttachment($propValue $displayImage $link false)

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.