CVE-2023-41046: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It is possible in XWiki to execute Velocity c...

Description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It is possible in XWiki to execute Velocity code without having script right by creating an XClass with a property of type "TextArea" and content type "VelocityCode" or "VelocityWiki". For the former, the syntax of the document needs to be set the `xwiki/1.0` (this syntax doesn't need to be installed). In both cases, when adding the property to an object, the Velocity code is executed regardless of the rights of the author of the property (edit right is still required, though). In both cases, the code is executed with the correct context author so no privileged APIs can be accessed. However, Velocity still grants access to otherwise inaccessible data and APIs that could allow further privilege escalation. At least for "VelocityCode", this behavior is most likely very old but only since XWiki 7.2, script right is a separate right, before that version all users were allowed to execute Velocity and thus this was expected and not a security issue. This has been patched in XWiki 14.10.10 and 15.4 RC1. Users are advised to upgrade. There are no known workarounds.

Metrics

CVSS 3.1

6.3/10

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

EPSS Probability

0.45%

35.5th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-862

Affected Software

Vendor	Product	Versions
Xwiki	Xwiki	>= 7.2, < 14.10.10
Xwiki	Xwiki	>= 15.0, < 15.4

References

https://github.com/xwiki/xwiki-platform/commit/edc52579eeaab1b4514785c134044671a1ecd839Patch
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-m5m2-h6h9-p2c8Issue Tracking, Patch, Third Party Advisory
https://jira.xwiki.org/browse/XWIKI-20847Issue Tracking, Vendor Advisory
https://jira.xwiki.org/browse/XWIKI-20848Issue Tracking, Vendor Advisory
https://github.com/xwiki/xwiki-platform/commit/edc52579eeaab1b4514785c134044671a1ecd839Patch
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-m5m2-h6h9-p2c8Issue Tracking, Patch, Third Party Advisory
https://jira.xwiki.org/browse/XWIKI-20847Issue Tracking, Vendor Advisory
https://jira.xwiki.org/browse/XWIKI-20848Issue Tracking, Vendor Advisory

Timeline

Published: Sep 1, 2023
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2023-41046?

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It is possible in XWiki to execute Velocity code without having script right by creating an XClass with a property of type "TextArea" and content type "VelocityCode" or "VelocityWiki". For the former, the syntax of the document needs to be set the `xwiki/1.0` (this syntax doesn't need to be installed). In both cases, when adding the property to an object, the Velocity code is executed regardless of the rights of the author of the property (edit right is still required, though). In both cases, the code is executed with the correct context author so no privileged APIs can be accessed. However, Velocity still grants access to otherwise inaccessible data and APIs that could allow further privilege escalation. At least for "VelocityCode", this behavior is most likely very old but only since XWiki 7.2, script right is a separate right, before that version all users were allowed to execute Velocity and thus this was expected and not a security issue. This has been patched in XWiki 14.10.10 and 15.4 RC1. Users are advised to upgrade. There are no known workarounds.

How severe is CVE-2023-41046?

CVE-2023-41046 has a CVSS score of 6.3/10 (MEDIUM severity). The EPSS model estimates a 0.45% probability of exploitation in the next 30 days.

How do I fix CVE-2023-41046?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.