{"id":"CVE-2023-29514","aliases":["GHSA-9j36-3cp4-rh4j"],"url":"https://o3.security/vulnerability/CVE-2023-29514","summary":"Code injection in template provider administration in xwiki-platform","details":"### Impact\n\nAny user with edit rights on any document (e.g., the own user profile) can execute code with programming rights, leading to remote code execution by following these steps:\n\n1. Set the title of any document you can edit (can be the user profile) to\n```\n    {{async async=\"true\" cached=\"false\" context=\"doc.reference\"}}{{groovy}}println(\"Hello \" + \"from groovy!\"){{/groovy}}{{/async}}\n```\n2. Use the object editor to add an object of type `XWiki.TemplateProviderClass` (named \"Template Provider Class\") to that document.\n3. Go to another document you can view (can be the home page) and append `?sheet=XWiki.AdminTemplatesSheet` to the URL.\n\nWhen the attack is successful, a template with name \"Hello from groovy!\" is displayed in the list while on fixed systems, the full title should be displayed.\n\n### Patches\n\nThis vulnerability has been patched in XWiki 13.10.11, 14.4.8, 14.10.1 and 15.0 RC1.\n\n### Workarounds\n\nThe vulnerability can be fixed by patching the code in the affected XWiki document as shown in the [patch](https://github.com/xwiki/xwiki-platform/commit/7bf7094f8ffac095f5d66809af7554c9cc44de09).\n\n### References\n\n* https://jira.xwiki.org/browse/XWIKI-20268\n* https://github.com/xwiki/xwiki-platform/commit/7bf7094f8ffac095f5d66809af7554c9cc44de09\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)\n* Email us at [Security Mailing List](mailto:security@xwiki.org)","published":"2023-04-18T23:48:12.348Z","modified":"2026-10-28T10:32:46.027408438Z","cvss":{"score":9.9,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":2,"affectedPackages":[{"ecosystem":"Maven","name":"org.xwiki.platform.applications:xwiki-application-administration","fixedVersion":null},{"ecosystem":"Maven","name":"org.xwiki.platform:xwiki-platform-administration","fixedVersion":null},{"ecosystem":"Maven","name":"org.xwiki.platform:xwiki-platform-administration-ui","fixedVersion":"13.10.11"},{"ecosystem":"Maven","name":"org.xwiki.platform:xwiki-platform-administration-ui","fixedVersion":"14.4.8"},{"ecosystem":"Maven","name":"org.xwiki.platform:xwiki-platform-administration-ui","fixedVersion":"14.10.1"}],"fix":{"url":"https://github.com/xwiki/xwiki-platform/commit/7bf7094f8ffac095f5d66809af7554c9cc44de09","label":"xwiki/xwiki-platform@7bf7094"},"references":[{"type":"WEB","url":"https://jira.xwiki.org/browse/XWIKI-20268"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/29xxx/CVE-2023-29514.json"},{"type":"ADVISORY","url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-9j36-3cp4-rh4j"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-29514"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/7bf7094f8ffac095f5d66809af7554c9cc44de09"},{"type":"PACKAGE","url":"https://github.com/xwiki/xwiki-platform"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T10:32:46.027408438Z"}}