CVE-2023-40573

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki supports scheduled jobs that contain Groovy scripts. Currently, the job checks the content author of the job for programming right. However, modifying or adding a job script to a document doesn't modify the content author. Together with a CSRF vulnerability in the job scheduler, this can be exploited for remote code execution by an attacker with edit right on the wiki. If the attack is successful, an error log entry with "Job content executed" will be produced. This vulnerability has been patched in XWiki 14.10.9 and 15.4RC1.

• CWE-284

• https://github.com/xwiki/xwiki-platform/commit/fcdcfed3fe2e8a3cad66ae0610795a2d58ab9662Patch
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-8xhr-x3v8-rghjPatch, Vendor Advisory
• https://jira.xwiki.org/browse/XWIKI-20852Exploit, Issue Tracking, Patch, Vendor Advisory
• https://github.com/xwiki/xwiki-platform/commit/fcdcfed3fe2e8a3cad66ae0610795a2d58ab9662Patch
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-8xhr-x3v8-rghjPatch, Vendor Advisory
• https://jira.xwiki.org/browse/XWIKI-20852Exploit, Issue Tracking, Patch, Vendor Advisory

Published

Aug 24, 2023

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-40568Rejected reason: GitHub has been informed that the requestor…
• CVE-2023-40569FreeRDP is a free implementation of the Remote Desktop Proto…9.8
• CVE-2023-4057Memory safety bugs present in Firefox 115, Firefox ESR 115.0…9.8
• CVE-2023-40570Datasette is an open source multi-tool for exploring and pub…5.3
• CVE-2023-40571weblogic-framework is a tool for detecting weblogic vulnerab…9.8
• CVE-2023-40572XWiki Platform is a generic wiki platform offering runtime s…8
• CVE-2023-40574FreeRDP is a free implementation of the Remote Desktop Proto…9.8
• CVE-2023-40575FreeRDP is a free implementation of the Remote Desktop Proto…9.1
• CVE-2023-40576FreeRDP is a free implementation of the Remote Desktop Proto…7.5
• CVE-2023-40577Alertmanager handles alerts sent by client applications such…5.4
• CVE-2023-40579OpenFGA is an authorization/permission engine built for deve…6.5
• CVE-2023-4058Memory safety bugs present in Firefox 115. Some of these bug…9.8