CVE-2023-35150

Katalog CVE

CVSS 8.0 · High EPSS 77,7%

Kerentanan Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') pada xwiki. Skor CVSS 3.1 8.0 (High) menurut NVD.

Deskripsi (NVD)

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 2.40m-2 and prior to versions 14.4.8, 14.10.4, and 15.0, any user with view rights on any document can execute code with programming rights, leading to remote code execution by crafting an url with a dangerous payload. The problem has been patched in XWiki 15.0, 14.10.4 and 14.4.8.

Rincian

Terbit di NVD

23 Juni 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.0 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

77,7% peluang dieksploitasi; lebih tinggi dari 99,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/xwiki/xwiki-platform/commit/b65220a4d86b8888791c3b643074ebca5c089a3a patch · advisory vendor
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-6mf5-36v9-3h2w advisory vendor
• https://jira.xwiki.org/browse/XWIKI-20285 exploit · issue tracking · patch · advisory vendor