CVE-2023-35152

XWiki Platform is a generic wiki platform. Starting in version 12.9-rc-1 and prior to versions 14.4.8, 14.10.6, and 15.1, any logged in user can add dangerous content in their first name field and see it executed with programming rights. Leading to rights escalation. The vulnerability has been fixed on XWiki 14.4.8, 14.10.6, and 15.1. As a workaround, one may apply the patch manually.

• CWE-95
• CWE-94

• https://github.com/xwiki/xwiki-platform/commit/0993a7ab3c102f9ac37ffe361a83a3dc302c0e45#diff-0b51114cb27f7a5c599cf40c59d658eae6ddc5c0836532c3b35e163f40a4854fR39Patch, Vendor Advisory
• https://github.com/xwiki/xwiki-platform/commit/6ce2d04a5779e07f6d3ed3f37d4761049b4fc3ac#diff-ef7f8b911bb8e584fda22aac5876a329add35ca0d1d32e0fdb62a439b78cfa49Patch, Vendor Advisory
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-rf8j-q39g-7xfmVendor Advisory
• https://jira.xwiki.org/browse/XWIKI-19900Issue Tracking, Vendor Advisory
• https://jira.xwiki.org/browse/XWIKI-20611Issue Tracking, Vendor Advisory
• https://github.com/xwiki/xwiki-platform/commit/0993a7ab3c102f9ac37ffe361a83a3dc302c0e45#diff-0b51114cb27f7a5c599cf40c59d658eae6ddc5c0836532c3b35e163f40a4854fR39Patch, Vendor Advisory
• https://github.com/xwiki/xwiki-platform/commit/6ce2d04a5779e07f6d3ed3f37d4761049b4fc3ac#diff-ef7f8b911bb8e584fda22aac5876a329add35ca0d1d32e0fdb62a439b78cfa49Patch, Vendor Advisory
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-rf8j-q39g-7xfmVendor Advisory
• https://jira.xwiki.org/browse/XWIKI-19900Issue Tracking, Vendor Advisory
• https://jira.xwiki.org/browse/XWIKI-20611Issue Tracking, Vendor Advisory

Published

Jun 23, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-35147Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier doe…6.5
• CVE-2023-35148A cross-site request forgery (CSRF) vulnerability in Jenkins…6.5
• CVE-2023-35149A missing permission check in Jenkins Digital.ai App Managem…6.5
• CVE-2023-3515Open Redirect in GitHub repository go-gitea/gitea prior to 1…4.4
• CVE-2023-35150XWiki Platform is a generic wiki platform offering runtime s…8
• CVE-2023-35151XWiki Platform is a generic wiki platform. Starting in versi…7.5
• CVE-2023-35153XWiki Platform is a generic wiki platform. Starting in versi…5.4
• CVE-2023-35154Knowage is an open source analytics and business intelligenc…6.5
• CVE-2023-35155XWiki Platform is a generic wiki platform offering runtime s…6.1
• CVE-2023-35156XWiki Platform is a generic wiki platform offering runtime s…6.1
• CVE-2023-35157XWiki Platform is a generic wiki platform offering runtime s…4.8
• CVE-2023-35158XWiki Platform is a generic wiki platform offering runtime s…6.1