XWiki Platform versions 7.0, before 14.4.8 and versions 14.5 before 14.10.4 suffer from an improper escaping in the document 'SkinsCode.XWikiSkinsSheet'. By leveraging this vulnerability, a remote and unauthenticated attacker can achieve privilege escalation and achieve code execution on the vulnerable XWiki instance.

XWiki 平台 7.0 版、14.4.8 之前的版本以及 14.5 之前的 14.10.4 版受到「SkinsCode.XWikiSkinsSheet」文件中的不當逸出問題影響。未經驗證的遠端攻擊者可利用此弱點，在受弱點影響的 XWiki 執行個體上實現特權提升，並實現程式碼執行。

XWiki Platform のバージョン 7.0 (14.4.8 より前) およびバージョン 14.5 (14.10.4 より前) は、ドキュメント「SkinsCode.XWikiSkinsSheet」で不適切なエスケープの影響を受けます。この脆弱性を利用することで、リモートの認証されていない攻撃者が権限昇格を実現し、脆弱な XWiki インスタンスでコードを実行する可能性があります。

XWiki Platform 低于 14.4.8 的 7.0 版本和低于 14.10.4 的 14.5 版本受到 "SkinsCode.XWikiSkinsSheet" 文档中不当转义漏洞的影响。未经身份验证的远程攻击者可利用此漏洞，在存在漏洞的 XWiki 实例上实现特权提升和代码执行。

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it.
    Improper escaping in the document `SkinsCode.XWikiSkinsSheet` leads to an injection vector from view right
    on that document to programming rights, or in other words, it is possible to execute arbitrary script
    macros including Groovy and Python macros that allow remote code execution including unrestricted read and
    write access to all wiki contents. The attack works by opening a non-existing page with a name crafted to
    contain a dangerous payload. It is possible to check if an existing installation is vulnerable. See the
    linked GHSA for instructions on testing an installation. This issue has been patched in XWiki 14.4.8,
    14.10.4 and 15.0-rc-1. Users are advised to upgrade. The fix commit `d9c88ddc` can also be applied
    manually to the impacted document `SkinsCode.XWikiSkinsSheet` and users unable to upgrade are advised to
    manually patch their installations. (CVE-2023-37462)

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
114451	XWiki Platform 7.0 < 14.4.8 / 14.5 < 14.10.4 Remote Code Execution	Web App Scanning	Component Vulnerability	2024/10/21	2024/10/21	high
114451	XWiki Platform 7.0 < 14.4.8 / 14.5 < 14.10.4 遠端程式碼執行	Web App Scanning	Component Vulnerability	2024/10/21	2024/10/21	high
114451	XWiki Platform 7.0 < 14.4.8 / 14.5 < 14.10.4 リモートコードの実行	Web App Scanning	Component Vulnerability	2024/10/21	2024/10/21	high
114451	XWiki Platform 7.0 < 14.4.8 / 14.5 < 14.10.4 远程代码执行	Web App Scanning	Component Vulnerability	2024/10/21	2024/10/21	high
415473	SCA: security update for org.xwiki.platform:xwiki-platform-skin-ui (GHSA-h4vp-69r8-gvjg)	Tenable Cloud Security	SCA Checks	2025/1/23	2026/7/16	high
415473	SCA: security update for org.xwiki.platform:xwiki-platform-skin-ui (GHSA-h4vp-69r8-gvjg)	Tenable Self-Hosted Container Security	SCA Checks	2025/1/23	2026/7/16	high

检测

插件搜索

high

high

high

high

high

high