CVE-2023-50732CWE-863

Velocity execution without script right through tree macro

High · published December 21, 2023

CVSS v3.1
8.3
EPSS
0%
Percentile
40.9
In the wild
Unconfirmed
What it is

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to execute a Velocity script without script right through the document tree. This has been patched in XWiki 14.10.7 and 15.2RC1.

The record
Technical detail
CVSS v3.1
8.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00486 · 40.9th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2023-12-21T19:42Z
EPSS history
Timeline
  • 21 DEC 19:42Z
    Velocity execution without script right through tree macro
    cvelistv5