CVE-2023-41046

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It is possible in XWiki to execute Velocity code without having script right by creating an XClass with a property of type "TextArea" and content type "VelocityCode" or "VelocityWiki". For the former, the syntax of the document needs to be set the `xwiki/1.0` (this syntax doesn't need to be installed). In both cases, when adding the property to an object, the Velocity code is executed regardless of the rights of the author of the property (edit right is still required, though). In both cases, the code is executed with the correct context author so no privileged APIs can be accessed. However, Velocity still grants access to otherwise inaccessible data and APIs that could allow further privilege escalation. At least for "VelocityCode", this behavior is most likely very old but only since XWiki 7.2, script right is a separate right, before that version all users were allowed to execute Velocity and thus this was expected and not a security issue. This has been patched in XWiki 14.10.10 and 15.4 RC1. Users are advised to upgrade. There are no known workarounds.

• CWE-862

• https://github.com/xwiki/xwiki-platform/commit/edc52579eeaab1b4514785c134044671a1ecd839Patch
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-m5m2-h6h9-p2c8Issue Tracking, Patch, Third Party Advisory
• https://jira.xwiki.org/browse/XWIKI-20847Issue Tracking, Vendor Advisory
• https://jira.xwiki.org/browse/XWIKI-20848Issue Tracking, Vendor Advisory
• https://github.com/xwiki/xwiki-platform/commit/edc52579eeaab1b4514785c134044671a1ecd839Patch
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-m5m2-h6h9-p2c8Issue Tracking, Patch, Third Party Advisory
• https://jira.xwiki.org/browse/XWIKI-20847Issue Tracking, Vendor Advisory
• https://jira.xwiki.org/browse/XWIKI-20848Issue Tracking, Vendor Advisory

Published

Sep 1, 2023

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-41040GitPython is a python library used to interact with Git repo…6.5
• CVE-2023-41041Graylog is a free and open log management platform. In a mul…3.1
• CVE-2023-41042Discourse is an open-source discussion platform. Prior to ve…6.5
• CVE-2023-41043Discourse is an open-source discussion platform. Prior to ve…6.5
• CVE-2023-41044Graylog is a free and open log management platform. A partia…3.8
• CVE-2023-41045Graylog is a free and open log management platform. Graylog …5.3
• CVE-2023-41047OctoPrint is a web interface for 3D printers. OctoPrint vers…6.5
• CVE-2023-41048plone.namedfile allows users to handle `File` and `Image` fi…5.4
• CVE-2023-41049@dcl/single-sign-on-client is an open source npm library whi…6.1
• CVE-2023-4105Mattermost fails to delete the attachments when deleting a m…4.3
• CVE-2023-41050AccessControl provides a general security framework for use …7.7
• CVE-2023-41051In a typical Virtual Machine Monitor (VMM) there are several…4.7