CVE-2023-36469

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user who can edit their own user profile and notification settings can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. This has been patched in XWiki 14.10.6 and 15.2RC1. Users are advised to update. As a workaround the main security fix can be manually applied by patching the affected document `XWiki.Notifications.Code.NotificationRSSService`. This will break the link to the differences, though as this requires additional changes to Velocity templates as shown in the patch. While the default template is available in the instance and can be easily patched, the template for mentions is contained in a `.jar`-file and thus cannot be fixed without replacing that jar.

• CWE-74

• https://github.com/xwiki/xwiki-platform/commit/217e5bb7a657f2991b154a16ef4d5ae9c29ad39cPatch
• https://github.com/xwiki/xwiki-platform/commit/217e5bb7a657f2991b154a16ef4d5ae9c29ad39c#diff-7221a548809fa2ba34348556f4b5bd436463c559ebdf691197932ee7ce4478caPatch
• https://github.com/xwiki/xwiki-platform/commit/217e5bb7a657f2991b154a16ef4d5ae9c29ad39c#diff-b261c6eac3108c3e6e734054c28a78f59d3439ab72fe8582dadf87670a0d15a4Patch
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-94pf-92hw-2hjcExploit, Patch, Vendor Advisory
• https://jira.xwiki.org/browse/XWIKI-20610Exploit, Issue Tracking, Patch, Vendor Advisory
• https://github.com/xwiki/xwiki-platform/commit/217e5bb7a657f2991b154a16ef4d5ae9c29ad39cPatch
• https://github.com/xwiki/xwiki-platform/commit/217e5bb7a657f2991b154a16ef4d5ae9c29ad39c#diff-7221a548809fa2ba34348556f4b5bd436463c559ebdf691197932ee7ce4478caPatch
• https://github.com/xwiki/xwiki-platform/commit/217e5bb7a657f2991b154a16ef4d5ae9c29ad39c#diff-b261c6eac3108c3e6e734054c28a78f59d3439ab72fe8582dadf87670a0d15a4Patch
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-94pf-92hw-2hjcExploit, Patch, Vendor Advisory
• https://jira.xwiki.org/browse/XWIKI-20610Exploit, Issue Tracking, Patch, Vendor Advisory

Published

Jun 29, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-36463Meldekarten generator is an open source project to create a …6.1
• CVE-2023-36464pypdf is an open source, pure-python PDF library. In affecte…5.5
• CVE-2023-36465Decidim is a participatory democracy framework, written in R…7.1
• CVE-2023-36466Discourse is an open source discussion platform. When editin…4.3
• CVE-2023-36467AWS data.all is an open source development framework to help…8.8
• CVE-2023-36468XWiki Platform is a generic wiki platform offering runtime s…8.8
• CVE-2023-3647The IURNY by INDIGITALL WordPress plugin before 3.2.3 does n…4.8
• CVE-2023-36470XWiki Platform is a generic wiki platform offering runtime s…8.8
• CVE-2023-36471Xwiki commons is the common modules used by other XWiki top …5.4
• CVE-2023-36472Strapi is an open-source headless content management system.…5.7
• CVE-2023-36473Discourse is an open source discussion platform. A CSP (Cont…6.1
• CVE-2023-36474Interactsh is an open-source tool for detecting out-of-band …6.1