VYPR
← All advisories
Critical severityNVD Advisory· Published Apr 18, 2023· Updated Feb 5, 2025

Privilege escalation from view right on XWiki.Notifications.Code.LegacyNotificationAdministration in xwiki-platform

CVE-2023-29525

Description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Affected versions of xwiki are subject to code injection in the since parameter of the /xwiki/bin/view/XWiki/Notifications/Code/LegacyNotificationAdministration endpoint. This provides an XWiki syntax injection attack via the since-parameter, allowing privilege escalation from view to programming rights and subsequent code execution privilege. The vulnerability has been patched in XWiki 15.0-rc-1, 14.10.3, 14.4.8 and 14.10.3. Users are advised to upgrade. Users unable to upgrade may modify the page XWiki.Notifications.Code.LegacyNotificationAdministration to add the missing escaping. For versions < 14.6-rc-1 a workaround is to modify the file <xwikiwebapp>/templates/distribution/eventmigration.wiki to add the missing escaping.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.xwiki.platform:xwiki-platform-distribution-warMaven
>= 12.6.1, < 13.10.1113.10.11
org.xwiki.platform:xwiki-platform-distribution-warMaven
>= 14.0-rc-1, < 14.4.814.4.8
org.xwiki.platform:xwiki-platform-distribution-warMaven
>= 14.5, < 14.6-rc-114.6-rc-1
org.xwiki.platform:xwiki-platform-legacy-events-hibernate-uiMaven
>= 14.6-rc-1, < 14.10.314.10.3

Affected products

1

Patches

2
8e7c7f90f2dd

XWIKI-20287: Improve migration date display

https://github.com/xwiki/xwiki-platformThomas MortagneDec 30, 2022via ghsa
commit
1 file changed · +1 −1
  • xwiki-platform-core/xwiki-platform-legacy/xwiki-platform-legacy-events-hibernate/xwiki-platform-legacy-events-hibernate-ui/src/main/resources/XWiki/Notifications/Code/LegacyNotificationAdministration.xml+1 −1 modified
    @@ -67,7 +67,7 @@ $services.localization.use('document', 'XWiki.Notifications.Code.LegacyNotificat
   &lt;div&gt;
     &lt;input type="radio" id="mode_since" name="mode" value="since"#if($request.mode == 'since')checked#end/&gt;
     &lt;label for="mode_since"&gt;$escapetool.html($services.localization.render('legacy.event.migration.since'))&lt;/label&gt;
-    &lt;input type="date" id="since" name="since" value="$!request.since" max="$datetool.format('yyyy-MM-dd', $datetool.date)"/&gt;
+    &lt;input type="date" id="since" name="since"#if($request.since) value="$escapetool.xml($request.since)"#end max="$datetool.format('yyyy-MM-dd', $datetool.date)"/&gt;
   &lt;/div&gt;
   &lt;div class="buttons"&gt;&lt;span class="buttonwrapper"&gt;&lt;input type="submit" value="$escapetool.xml($services.localization.render('legacy.event.migration.start'))" name="migrate" class="button"/&gt;&lt;/span&gt;&lt;/div&gt;
 &lt;/form&gt;
6d74e2e4aa03

XWIKI-20287: Improve migration date display

https://github.com/xwiki/xwiki-platformThomas MortagneDec 30, 2022via ghsa
commit
1 file changed · +1 −1
  • xwiki-platform-core/xwiki-platform-legacy/xwiki-platform-legacy-events-hibernate/xwiki-platform-legacy-events-hibernate-ui/src/main/resources/XWiki/Notifications/Code/LegacyNotificationAdministration.xml+1 −1 modified
    @@ -67,7 +67,7 @@ $services.localization.use('document', 'XWiki.Notifications.Code.LegacyNotificat
   &lt;div&gt;
     &lt;input type="radio" id="mode_since" name="mode" value="since"#if($request.mode == 'since')checked#end/&gt;
     &lt;label for="mode_since"&gt;$escapetool.html($services.localization.render('legacy.event.migration.since'))&lt;/label&gt;
-    &lt;input type="date" id="since" name="since" value="$!request.since" max="$datetool.format('yyyy-MM-dd', $datetool.date)"/&gt;
+    &lt;input type="date" id="since" name="since"#if($request.since) value="$escapetool.xml($request.since)"#end max="$datetool.format('yyyy-MM-dd', $datetool.date)"/&gt;
   &lt;/div&gt;
   &lt;div class="buttons"&gt;&lt;span class="buttonwrapper"&gt;&lt;input type="submit" value="$escapetool.xml($services.localization.render('legacy.event.migration.start'))" name="migrate" class="button"/&gt;&lt;/span&gt;&lt;/div&gt;
 &lt;/form&gt;

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

6

News mentions

0

No linked articles in our index yet.